A newly published Microsoft Defender zero-day can stop Windows antivirus updates while the proof-of-concept tool is running, leaving affected PCs stuck on older protections. Researcher Abdelhamid Naceri, also known as Nightmare Eclipse, said the issue dubbed BigDiskBuster works across supported Windows versions and prevents Defender platform and signature updates. No CVE or vendor patch was listed at publication, and the current release is a public proof of concept that must keep running in the background.
Why it matters: People and organizations that rely on Microsoft Defender could be left without new malware signatures or engine updates if this technique is used on their systems. Microsoft users should watch for an official fix and defenders should monitor for unauthorized processes that interfere with Defender updating.
info@thehackernews.com (The Hacker News)
2026.09.22
99% relevant
This article appears to cover the same underlying event: the public release of BigDiskBuster proof-of-concept code showing a Microsoft Defender zero-day that prevents Defender updates while the tool is running.
Eduard Kovacs
2026.09.22
98% relevant
This article directly covers the same underlying event: the public release of the BigDiskBuster Microsoft Defender exploit. It adds that the leaker Nightmare Eclipse identified himself as Abdelhamid Naceri, described BigDiskBuster as similar to UnDefend, and said it affects all currently supported Windows versions.
Sergiu Gatlan
2026.09.22
100% relevant
This article establishes a distinct newly disclosed Microsoft Defender zero-day, BigDiskBuster, separate from earlier Naceri-released flaws such as ShieldBreak, ShieldCrash, RoguePlanet, and UnDefend.
← Back to all stories