KiL SecC

*something cool*

[IT Guy @T3chFalcon]

Nightmare Eclipse.

Reportedly a former Microsoft security employee.

The story: they found critical vulnerabilities inside Microsoft. reported them internally. Microsoft ignored the reports, deleted their accounts, and refused to pay the bug bounties.

so they went public.

Timing every release to drop within hours of Microsoft's monthly Patch Tuesday, the day Microsoft fixes other vulnerabilities, so the new ones land before defenders have time to breathe.

here's what they've dropped since April:

BlueHammer, CVE-2026-33825. exploits Microsoft Defender to redirect SYSTEM-level file writes into System32. patched. then actively exploited by real attackers within days.

RedSun — SYSTEM-level privilege escalation via Defender. now in live attacks.

UnDefend — blocks Defender from receiving definition updates entirely. observed in live intrusions. your antivirus stops updating. silently.

YellowKey — bypasses BitLocker on TPM-only configurations. fixed June Patch Tuesday.

GreenPlasma — SYSTEM-level privilege escalation via CTFMON. fixed June Patch Tuesday.

MiniPlasma — resurrected a patched 2020 flaw that Microsoft let regress.

RoguePlanet — the latest. no CVE. no patch. dropped June 9, hours after Patch Tuesday.

now let's talk about RoguePlanet specifically because it's the most alarming.

it exploits a race condition in Microsoft Defender itself. the component designed to protect your system runs as SYSTEM — the highest privilege level on Windows. it has to, so it can quarantine and delete malware anywhere on disk.

RoguePlanet tricks Defender into performing a SYSTEM-level file write into a location the attacker controls. The result: a standard user gets a command prompt running as NT AUTHORITY\SYSTEM on a fully patched Windows 10 or 11 machine.

Microsoft hardened Defender in May to block this class of attack. Nightmare Eclipse rewrote it to bypass the hardening and released it the same day as Patch Tuesday.

ThreatLocker independently confirmed it works on fully patched Windows 11.

BlueHammer, RedSun, and UnDefend the earlier releases were already picked up by real threat actors and used in live intrusions. Huntress documented this. a researcher dropping PoC exploits to punish a corporation is one thing. those exploits getting weaponized by ransomware groups is something else entirely.

Microsoft's response:

they flagged the researcher's blogs. took down their GitHub. threatened legal action. called it potential criminal activity.

the cybersecurity community responded with fury. researchers don't work for Microsoft. if a company ignores internal reports and refuses to pay bounties, public disclosure is the entire point of responsible disclosure culture.

Microsoft backed down. said they had no intention of pursuing legal action against security researchers.

Nightmare Eclipse released RoguePlanet the same week.

Microsoft built a bug bounty program to stop exactly this.

they ignored the reports.

now every Windows machine on earth is waiting for a patch that doesn't exist yet.

[vx-underground @vxunderground]

Honestly, if you're wanting to get into malware development and malware reverse engineering (specifically in regards to Windows), I think the most important thing you can learn is the concept of a file.

1. What is a file extension? This is pretty obvious, .exe, .pdf, .mp3, etc.

2. How are file extensions handled? This would introduce the idea of the Windows registry and how extension querying is handled vs. the Windows loader

3. Which file extensions (or file types, rather) are used for payload delivery? e.g. .exe, .dll, .xll, .vbs, .ps1, .py, .lua, .docx, .vcproj, etc. The .exe, .dll, (and other native types, like .sys) will be sort of self-explanatory, but the others would introduce different malware delivery mechanisms (malicious files) and potentially wiggle in the concept of payload smuggling.

4. Each of the previous listed file types are different. How are they different? .exe and .dll (and many others) are native to Windows and handled by the Windows loader. Why are the others still considered executable files? This is when you slowly step into interpretive languages and VM dependency (JVM, PVM, etc).

Somewhere in this you would eventually stumble into the Windows PE format, how the PE format is different for .NET binaries, how Electron .JS executables act differently, weird stuff like .docx file internals, etc.

Basically, I think understanding files and how they're handled is an excellent starting point and sets the stage for what will happen next.

pic unrelated

[KiL SecC @0xFFFFFD5]

Real

[GlitchLabs @_GlitchLabs]

@vxunderground Reverse engineers have more beef w/ files than I have w/ real people

[vx-underground @vxunderground]

Cybersecurity researchers keep getting flagged and/or suspended on X.

Chat, it's only a matter of time for me. If I die, please collect pictures of cats in my honor.

[KiL SecC @0xFFFFFD5]

@MrBeast Man the fuck up

[kanav @kanavtwt]

Day 1 of vibecoding

[JDZ Football @JDZFootball]

Tu me manques.

[Speed⭐️ @ishowspeedsui]

come on algeria man really

[vx-underground @vxunderground]

Holy cow

Unlimited AI usage!!!!

Just run GPT_Claude_Free.exe as admin

[KiL SecC @0xFFFFFD5]

@nord_africain_f @Sonkeii12 @algeriactufoot_ YES RETARD, EVERY DAMN STAT NUMBER SAYS THAT, YOU STILL USE CHARCOAL FOR COOKING

[vx-underground @vxunderground]

Anti-malware companies vs me doing malware analysis

[Spencer Baggins @bigaiguy]

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.

He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.

His name is Fabrice Bellard.

Here is the story, because almost nobody outside the systems programming world knows what one man has built.

Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.

In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.

Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.

He was not done.

In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.

He kept going.

In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.

In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.

Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.

Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org

He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.

A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.

He is still shipping.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Sergey Nazarov @sergeynazarovx]

We used to go to a special website, ask strangers for help with programming, and get humiliated in return

[vx-underground @vxunderground]

ShinyHunters got access to Canvas infrastructure from ... "Vishing".

Social engineering.

WHY IS IT ALWAYS FUCKING SOCIAL ENGINEERING

[KiL SecC @0xFFFFFD5]

Left my 3rd world country and never cameback

[y @ysuckme]

speak it into existence .. by the end of this year, you will have _____?

[y @ysuckme]

speak it into existence .. by the end of this year, you will have _____?

[mnux :3 🌸 @mnux5]

who forgot their switch on the bus😭😭

[KiL SecC @0xFFFFFD5]

@Astro_Jessica @Space_Station عرق طرطقلي من الفخر🥵🥵🥵
🇩🇿 🇩🇿 🇩🇿 🇩🇿 🇩🇿 🇩🇿 🇩🇿 🇩🇿 🇩🇿

[vx-underground @vxunderground]

OS?
Windows 11

Browser?
Chrome

Password Manager?
Passwords.txt

Antivirus?
Defender

VPN?
Nord

All telemetry features enabled to improve the products listed.