Nightmare Eclipse Drops 10th Windows Zero-Day After Threat

What happened

A security researcher operating under the handle Nightmare Eclipse has published another Windows zero-day vulnerability, defying a public legal threat from Microsoft over prior disclosures 1. According to reporting, this marks the tenth zero-day this researcher has released, and like several before it, the disclosure landed shortly after a Patch Tuesday cycle, a pattern that appears deliberate rather than coincidental 3. The move comes at a moment when Microsoft is already straining under an unusually heavy patching workload: the company's latest Patch Tuesday addressed a record 974 vulnerabilities, including two Windows zero-days that attackers were actively exploiting before fixes existed 7.

The Nightmare Eclipse saga is unfolding alongside a broader wave of urgent security disclosures across the industry. GitLab was forced to respond after a critical path-traversal flaw in its platform was exploited just one day after the vulnerability was disclosed, giving unauthenticated attackers a way to read arbitrary files off GitLab servers 2. Google pushed an emergency Chrome update for a high-severity zero-day, tracked as CVE-2026-85046, that was already being exploited in the wild, prompting warnings that users needed to update their browsers immediately 4. And remote-monitoring vendor N-able has been dealing with its own cluster of trouble: researchers flagged unusual threat activity tied to a since-patched flaw in its N-central RMM platform 5, and separately the company disclosed and patched two additional vulnerabilities before revealing a third bug in the same product carrying a maximum CVSS score of 10.0, sending administrators scrambling to patch three times in quick succession 6.

Why it matters

Taken together, these stories describe a security landscape where the gap between disclosure and exploitation is collapsing. The GitLab flaw's one-day turnaround from publication to active attack 2, the pre-patch exploitation of Chrome's CVE-2026-85046 4, and Microsoft's own admission that two Windows zero-days were already being weaponized before it could ship fixes 7 all point to attackers moving faster than defenders can respond. Nightmare Eclipse's continued releases add a different kind of pressure: a researcher willing to disclose unpatched Windows flaws publicly, regardless of legal consequences, effectively forces Microsoft into the same reactive posture that ransomware crews and nation-state actors create through exploitation 13. For enterprise IT teams, the N-able situation illustrates how quickly a single vendor's patching burden can multiply, with three distinct vulnerabilities in one RMM platform surfacing within a matter of days 56.

Where the reporting agrees

Across the sources, there is consistent agreement that zero-day disclosure and exploitation timelines are shrinking. Coverage of GitLab, Chrome, and N-able all describes vulnerabilities being exploited or flagged for active abuse within a day or two of becoming known 2456. The Nightmare Eclipse coverage is also consistent in its central facts: TechCrunch and Yahoo both describe a researcher releasing Windows zero-days despite Microsoft's legal threats, and both connect the timing of releases to the Patch Tuesday cycle 13. There is no dispute that Microsoft's most recent patch batch was unusually large and included zero-days already under attack 7.

Where it doesn't

The clearest point of difference is granularity rather than contradiction. Yahoo's account adds a specific detail not found in the TechCrunch piece: that this is explicitly the researcher's tenth zero-day disclosure, a count that frames Nightmare Eclipse's campaign as a sustained, numbered pattern rather than a single incident 3. TechCrunch's framing emphasizes the legal confrontation with Microsoft as the headline tension, while Yahoo leans into the researcher's track record and the recurring Patch Tuesday timing as the more newsworthy thread 13. Separately, the N-able coverage shows a sequencing discrepancy worth flagging: one account describes researchers warning the company about suspicious activity tied to an already-patched flaw 5, while another describes N-able disclosing and patching two bugs first, then issuing a third patch for a maximum-severity zero-day a day later 6. These aren't strictly contradictory, but they describe overlapping events from different vantage points, and neither source cross-references the other's version of the timeline.

The bottom line

The available reporting does not fully reconcile how many discrete N-able vulnerabilities were involved or in what exact order they were flagged versus patched, and readers should treat the two-outlet account as complementary rather than a single confirmed sequence. On Nightmare Eclipse, the evidence across both outlets supports treating this as an ongoing, numbered campaign against Microsoft rather than an isolated leak, given the consistent tenth-disclosure detail and the repeated post-Patch-Tuesday timing noted independently by each outlet.