Vulnerabilities · 51 days ago
Abdelhamid Naceri, better known as NightmareEclipse, publicly revealed his identity and released BigDiskBuster, a proof of concept that keeps Microsoft Defender Antivirus from completing platform and signature updates. SecurityWeek and The Hacker News both reported the release, and the code is still described as buggy and unpatched.
The trick does not disable Defender. It waits for an update to start, then fills the remaining disk space so the update cannot finish; once the failure happens, it removes the temporary files. That leaves Defender running but stuck on older detection content, so the gap is quiet rather than obvious.
For Windows estates that assume a running endpoint agent means current protection, the exposure is the stale-update window itself. The compatibility claim is still unverified, but the public PoC shows a failure mode that can leave little residue after the update attempt ends.
4 sources covering this story
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
BigDiskBuster can block Microsoft Defender updates by filling disk space, leaving detection content stale; no patch or advisory exists.
NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
BigDiskBuster leaves Microsoft's antivirus running but unable to install updates
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse.
New Windows Defender zero-day blocks Microsoft antivirus updates
Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates.
Part of the PlainSec briefing for 2026-09-23