'BlueHammer' Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues

A researcher publicly released exploit code for a Windows zero-day called "BlueHammer" that abuses a TOCTOU race condition and path confusion in Windows Defender’s signature update mechanism to read the SAM database and enable privilege escalation via pass-the-hash. The PoC reportedly works on client desktops (not reliably on servers), may be imperfect, and Microsoft had not yet patched the flaw at the time of reporting, increasing the likelihood of criminal or APT actors adapting the code for real-world attacks.