Windows 0-day drops the same day Microsoft releases record number of patches

Ars Technica reports that a security researcher known as NightmareEclypse has released working exploit code for a Windows privilege-escalation vulnerability, arriving the same day Microsoft released a record number of security patches. The flaw, called HiveLegacy, lets low-privilege user accounts compromise administrator access by modifying the Windows registry hive that controls which applications open certain file types. The researcher intentionally stripped down the proof-of-concept code to limit malicious misuse, though independent researchers have confirmed the exploit is functional. This marks the ninth zero-day NightmareEclypse has published, a pattern suggesting ongoing frustration with how Microsoft handles vulnerability reports.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton