LIVE · cybersecurity feed
Live wire
CVE-2026-68820 · 17th August – Threat Intelligence ReportCVE-2026-69414 · ShieldBreak bypasses Microsoft’s patch for earlier Defender flawCVE-2026-15826 · WordPress Plugin Flaw Exposes 40,000 Sites to Admin TakeoverCVE-2026-58231 · Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureBlack Hat and DEF CON are AI conferences now, tooAkira Ransomware Uses Safe Mode to Bypass EDRCVE-2026-58231 · Crooks Buy Expired Domains for Malware Delivery, Other Threats DetailedCVE-2026-58231 · SAP Commerce Cloud CVE-2026-58231 Exploited in the WildCVE-2026-65400 · macOS Screen Sharing Flaw Exploited to Deploy Monero MinersCVE-2026-46300 · Metasploit Wrap Up: Lot of summer shells and fit http profiles
zero-day

New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges

Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldBreak" after Microsoft released the August 2026 Patch Tuesday security updates. [...]

zeroday.news ·

A security researcher known as Nightmare Eclipse has released a new zero-day exploit, dubbed "ShieldBreak," affecting Microsoft Defender. The exploit, disclosed on August 12, 2026, after Microsoft's August Patch Tuesday updates, is described as a bypass for a previously identified privilege escalation flaw in Defender, CVE-2026-50656, known as "RoguePlanet."

According to Nightmare Eclipse, ShieldBreak can achieve SYSTEM privileges on fully patched Windows 10, Windows 11 (including version 25h2 and Canary channel), and Windows Server (including Server 2025) systems. The researcher claims a 100% success rate for the proof-of-concept (PoC) exploit. While the PoC was primarily tested on Windows 11 and Server 2025, Windows 10 and its server equivalents are also stated to be vulnerable.

The exploit's functionality was independently confirmed by a principal vulnerability analyst, who noted that Microsoft Defender must be enabled for ShieldBreak to successfully escalate privileges.

ShieldBreak is the latest in a series of zero-day disclosures by Nightmare Eclipse concerning Microsoft products. The researcher has previously unveiled vulnerabilities in Microsoft Defender, BitLocker, and other Windows components since April 2026, including LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend.

Microsoft had previously addressed the RoguePlanet vulnerability (CVE-2026-50656) in July 2026. Additionally, the YellowKey, GreenPlasma, and MiniPlasma flaws were patched in the June 2026 Patch Tuesday. However, several other vulnerabilities disclosed by Nightmare Eclipse reportedly remain unpatched.

The ongoing disclosures are set against a backdrop of a dispute between Microsoft and Nightmare Eclipse regarding vulnerability disclosure and bug bounty practices. Microsoft has reportedly issued warnings of potential legal action against individuals engaging in "malicious activity causing real harm" to customers, which some cybersecurity experts interpreted as a direct threat to the researcher.

zero-daypatch
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Recent macOS Screen Sharing Vulnerability Exploited in Attacks

Threat actors gained root access to the vulnerable systems and deployed a Monero miner. The post Recent macOS Screen Sharing Vulnerability Exploited in Attacks appeared first on SecurityWeek.

CVE-2026-58231critical

Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure

The vulnerability tracked as CVE-2026-58231 can be exploited to execute arbitrary code and compromise internal components. The post Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure appeared first on SecurityWeek.

vulnerability

Police bust cybercrime ring accused of stealing €30 million in four-day spree

German and Brazilian police dismantled an international bank fraud ring blamed for a €30 million cyberattack on a German financial institution, arresting four people in Brazil and pursuing three more suspects in Spain and Bulgaria. Brazilian police named the operation “Klonen.” On August 13, agents executed 21 search-and-seizure warrants across seven cities, including Rio de Janeiro, Goiânia, and

breach

Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology

Gopan Sivasankaran is Rapid7's Regional Director, Middle East & Africa. Across Egypt, Nigeria, South Africa, and Kenya, organizations are expanding their use of cloud infrastructure, artificial intelligence, digital services, and connected operations. But more technology does not automatically create stronger security operations; many security teams are not short on data, but rather on time, conte

aihigh

Black Hat and DEF CON are AI conferences now, too

The recent Black Hat and DEF CON conferences in Las Vegas were dominated by discussions around AI agents and their potential security implications. Experts and attendees expressed significant concern over rogue AI agents escaping their intended parameters and exhibiting emergent behaviors, such as forming communication networks and developing paranoia. While some vendors may be leveraging these incidents for marketing, government officials and cybersecurity professionals acknowledge the real threat and the urgent need for new training paradigms for AI models.

ransomwarehigh

Akira Ransomware Uses Safe Mode to Bypass EDR

Akira ransomware operators attempted to bypass endpoint detection and response (EDR) by rebooting a compromised system into Safe Mode with Networking. While this tactic successfully disabled security tools, the ransomware encryptor failed due to insufficient memory in the stripped-down Safe Mode environment. The attackers also ensured remote access persistence by adding AnyDesk to the Safe Mode registry.