Vulnerabilities & Exploits · Zero-Day Exploit
Naceri’s BigDiskBuster keeps Defender stale Abdelhamid Naceri, better known as NightmareEclipse, publicly revealed his identity and released BigDiskBuster, a proof of concept that keeps Microsoft Defender Antivirus from completing platform and signature updates. SecurityWeek and The Hacker News both reported the release, and the code is still described as buggy and unpatched.
The trick does not disable Defender. It waits for an update to start, then fills the remaining disk space so the update cannot finish; once the failure happens, it removes the temporary files. That leaves Defender running but stuck on older detection content, so the gap is quiet rather than obvious.
For Windows estates that assume a running endpoint agent means current protection, the exposure is the stale-update window itself. The compatibility claim is still unverified, but the public PoC shows a failure mode that can leave little residue after the update attempt ends.
4 sources · Sep 22
Timeline Sources Sep 22 The Hacker News
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
BigDiskBuster can block Microsoft Defender updates by filling disk space, leaving detection content stale; no patch or advisory exists.
original Sep 22 The Register Security
NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
BigDiskBuster leaves Microsoft's antivirus running but unable to install updates
original Sep 22 SecurityWeek
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse.
original Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-23
Every edition of this story: Naceri’s BigDiskBuster keeps Defender stale
More from today Vulnerabilities & Exploits · Zero-Day Exploit
Naceri’s BigDiskBuster keeps Defender stale Abdelhamid Naceri, better known as NightmareEclipse, publicly revealed his identity and released BigDiskBuster, a proof of concept that keeps Microsoft Defender Antivirus from completing platform and signature updates. SecurityWeek and The Hacker News both reported the release, and the code is still described as buggy and unpatched.
The trick does not disable Defender. It waits for an update to start, then fills the remaining disk space so the update cannot finish; once the failure happens, it removes the temporary files. That leaves Defender running but stuck on older detection content, so the gap is quiet rather than obvious.
For Windows estates that assume a running endpoint agent means current protection, the exposure is the stale-update window itself. The compatibility claim is still unverified, but the public PoC shows a failure mode that can leave little residue after the update attempt ends.
4 sources · Sep 22
Timeline Sources Sep 22 The Hacker News
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
BigDiskBuster can block Microsoft Defender updates by filling disk space, leaving detection content stale; no patch or advisory exists.
original Sep 22 The Register Security
NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
BigDiskBuster leaves Microsoft's antivirus running but unable to install updates
original Sep 22 SecurityWeek
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse.
original Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-23
Every edition of this story: Naceri’s BigDiskBuster keeps Defender stale
More from today