Researcher Accuses Microsoft of GitHub Ban After Windows Exploit Releases

A public dispute between Microsoft and security researcher Nightmare-Eclipse, also known as Chaotic Eclipse, is escalating after the researcher claimed Microsoft banned their GitHub account following a series of Windows zero-day disclosures.

The controversy started in early April after Eclipse released BlueHammer, a Windows zero-day exploit, without giving Microsoft advance notice. The researcher continued releasing proof-of-concept exploits, and Microsoft recently condemned the YellowKey release because it did not follow the coordinated vulnerability disclosure practices normally used between researchers and vendors.

Eclipse argues that the situation developed because Microsoft ignored or rejected previous reports and failed to communicate properly through the Microsoft Security Response Center (MSRC). The researcher also claims Microsoft caused financial harm by refusing payouts tied to vulnerability submissions.

Researcher Moves Work to GitLab

According to Eclipse, Microsoft banned their GitHub account shortly after the dispute escalated. The researcher has since moved projects and exploit research to GitLab.

Eclipse also claims Microsoft previously deleted the Microsoft account used to submit vulnerability reports. Microsoft has not publicly addressed either accusation.

The dispute has attracted attention because GitHub operates under Microsoft ownership, raising concerns among some researchers about how platform access could be affected during security disputes.

Eclipse Teases More Zero-Day Disclosures

Eclipse claims to have already disclosed six Windows zero-day exploits publicly, including BlueHammer, RedSun, UnDefend, GreenPlasma, MiniPlasma, and YellowKey.

The researcher is now teasing additional disclosures planned for July 14. The situation has also renewed criticism around Microsoft’s bug bounty program, which can pay substantial rewards for serious vulnerabilities.

Eclipse suggests their reports were either mishandled or not compensated properly through MSRC.

Security Community Questions Microsoft’s Handling

The dispute has triggered debate within the security community. Security expert Will Dormann suggested Microsoft’s response process may no longer be as effective as it once was.

He speculated that MSRC could now rely too heavily on rigid procedures, including requests for exploit videos and strict disclosure requirements before engaging with researchers.

At the same time, some security researchers criticized Eclipse for publicly releasing active zero-days without giving Microsoft time to develop patches.

Microsoft Remains Silent

Microsoft has not publicly explained the reported GitHub ban or commented on the wider dispute with Eclipse.

That leaves open questions about whether the conflict stems from an uncooperative researcher, internal handling problems at Microsoft, or a broader breakdown in trust between vendors and independent security researchers.

Via Tom’s Hardware