🟠High  | Source: The Register — Security
A security researcher has publicly leaked Microsoft exploit code in protest at how the company handles vulnerability disclosures, following a similar incident by a researcher known as Nightmare Eclipse. The researcher chose to bypass responsible disclosure and release exploits immediately, arguing Microsoft’s process is inadequate. This creates immediate risk as working exploit code is now publicly available before patches may be widely applied.
Architect’s Take: Review your Azure and Microsoft 365 patch status urgently and prioritise any outstanding Microsoft security updates, as publicly available exploit code significantly shortens the window between disclosure and active exploitation. Monitor Microsoft’s Security Response Center and threat intelligence feeds closely for CVE details tied to these leaks.
Original advisory: Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures