microsoft threatened to sue a researcher for going public. he just broke their patch — again

Microsoft patched a Windows Defender bug called RoguePlanet in July 2026 — a flaw that let a standard user spawn a SYSTEM-level command shell on a fully updated machine. On August 12, a researcher Microsoft had publicly threatened with legal action three months earlier published a working bypass of that exact patch, called ShieldBreak. It runs on Windows 10, Windows 11 25H2, and Windows Server 2025, and as of this writing there's still no fix for it.

What RoguePlanet actually does

RoguePlanet lives in mpengine.dll, the Malware Protection Engine that every Defender scan runs through. Researchers describe it as a race condition combined with improper link resolution — Defender briefly touches a file path in a way that a local attacker can hijack mid-operation, redirecting the engine's elevated scanning process into spawning a command shell with SYSTEM rights instead. No remote access is needed; the attacker just needs to already be running code on the box, even as a low-privilege user. Arctic Wolf's writeup notes initial weaponization of the underlying bug appeared in early June 2026, roughly a month before Microsoft's fix shipped.

The bypass: why the July patch didn't hold

Microsoft's July 9 patch closed the specific race condition researchers had reported. ShieldBreak, published five weeks later, claims to find a different path through the same underlying weakness in mpengine.dll — restoring the SYSTEM shell on machines running the patched engine. The proof-of-concept was tested against Windows 11 25H2, the Canary channel, and Windows Server 2025, and its author reports a 100% success rate. A Microsoft spokesperson told TechCrunch the company is 'aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims' — language that stops short of confirming it, but doesn't dispute it either.

The backstory Microsoft would rather you didn't connect

In May 2026, Microsoft published a blog post threatening legal action against security researchers who release zero-day details outside the company's official disclosure process. The company partially walked the comments back on social media afterward, but the original post was never formally retracted. Nightmare Eclipse, the researcher behind ShieldBreak, has published several Windows and Defender vulnerabilities through 2026 and has publicly accused Microsoft of mishandling bug reports, framing public disclosure as the option left after Microsoft's own process failed.

This is the second time in a month a nation-state-adjacent Windows flaw has made headlines — Lazarus was caught hiding a separate zero-day inside fake job offers for five weeks — and it lands right after Microsoft cleared three perfect-10 bugs in Azure and Teams days before this month's Patch Tuesday. Defender bypasses are a particularly ugly category because the tool meant to catch the attacker is the thing getting exploited.

Microsoft says it's investigating; it hasn't confirmed or denied ShieldBreak works as described, and there's no public timeline for a second fix. What's confirmed is the pattern: a company that spent May threatening researchers over disclosure timing spent August dealing with a disclosure from the exact researcher it threatened. Whatever you think of Nightmare Eclipse's approach, the bug itself doesn't care about the feud — patch or mitigate, because right now the only thing standing between a standard user and SYSTEM is whether they've read this far.