Microsoft's Zero-Day Legal Threats Spark Backlash

Microsoft was criticized after an anonymous researcher known as "Nightmare-Eclipse" published multiple zero-day vulnerabilities and PoC exploits (including BlueHammer/CVE-2026-33825, RedSun, Undefend, YellowKey, GreenPlasma, MiniPlasma) that were reportedly exploited in the wild; MSRC's initial blog post threatening criminal prosecution prompted broad backlash from the security community and was later softened, while the researcher signaled potential further drops and other researchers reportedly contributed vulnerabilities.