Since April 2026, someone had been releasing Windows and Defender zero-days at a pace of roughly two a month, under a rotating cast of handles - Nightmare Eclipse, and earlier Chaotic Eclipse and MSNightmare. In August, we wrote about ShieldBreak, his bypass of a Defender patch, and noted that the person behind it had, by his own account, gone public after Microsoft mishandled his private bug reports. This month he stopped disclosing anonymously. According to Cybernews, the researcher is Abdelhamid Naceri, a former Microsoft security employee credited by the Zero Day Initiative since 2020 for earlier work including a Windows lock-screen bypass.
A dismissal letter, a "Tom", and a Cologne courtroom
Naceri's version of events, as he's now told it publicly, starts with a dismissal letter dated 3 March 2025. He says a Microsoft contact he refers to only as "Tom" told him in a meeting that he was fired because he'd "harmed Microsoft's customers" - a reason he disputes, and which he took to the labour court in Cologne, Germany, where he was based. Roughly two years of proceedings followed. Per SecurityWeek's reporting, the court ultimately upheld Microsoft's termination, and Naceri says the case cost him more than $200,000 along with a serious toll on his mental health. None of that history changes whether any individual exploit he's published actually works - but it's the context he himself has offered for why a stream of zero-days, rather than a normal coordinated-disclosure relationship, is what Microsoft has been getting from him since.
The part he's now walked back
Here's the detail that complicates his own narrative rather than supporting it: SecurityWeek reports that Naceri has acknowledged fabricating an earlier claim that Microsoft had taken legal action against him personally. That's a different thing from Microsoft's actual May 2026 blog post warning that it would consider legal action against researchers who disclose outside official channels - a real post, from Microsoft, that other outlets including TechCrunch reported on and that we referenced in our August piece. What Naceri has now said wasn't true is his own, separate claim of having been personally sued. It's a reminder that a source can be right about the underlying vulnerability and wrong, or dishonest, about part of the story built around it - and that the two need checking independently.
BigDiskBuster: no CVE, no patch, works on every supported version
About a week after going public with his name, Naceri released BigDiskBuster over a weekend - a proof-of-concept that, in his own words, "completely denies Defender from updating so you're stuck with your current version if the tool is running in the background." It builds on UnDefend, an April release with a similar goal, and according to BleepingComputer, it reportedly works across all currently supported Windows versions, though Naceri himself flags it as buggy and in need of rework. No CVE has been assigned. No patch exists. Microsoft had no comment ready when either BleepingComputer or SecurityWeek asked. Whatever you make of the story around it, the practical fact for defenders is unchanged from every other release in this run: a working technique is public, and the vendor hasn't caught up yet.
- Don't rely on Defender's own console status to confirm it's current - monitor platform and signature version drift independently, since BigDiskBuster's entire premise is that Defender can silently stop updating while still reporting as active.
- Treat "no CVE assigned" as a gap in tracking, not a signal of low severity - this researcher's exploits have consistently shipped working code well before any vendor reference number exists.
- Keep watching this specific disclosure lineage rather than triaging each release in isolation; fourteen flaws since April from one source, most against Defender or core Windows components, is itself an input to your threat model.
- Verify claims made alongside a technical disclosure separately from the technical disclosure itself - this case shows a researcher's exploit code can be sound even where part of the surrounding account isn't, and the two deserve independent scrutiny.
A vulnerability doesn't become less real because the story around its discovery gets complicated - it just means you have to read the technical claim and the personal one separately. If you want a second opinion on your Defender hardening posture while this particular gap sits unpatched, email sales@halfteck.com.