Microsoft disputes a 0-day vulnerability hunter’s claims while multiple exploits are reported as active

Several outlets report a dispute involving a vulnerability hunter identified as “Nightmare Eclipse” and Microsoft, centered on claims that Microsoft is responding to allegations around Windows 0-day vulnerabilities. The Register and AnandTech both reference Microsoft’s actions and the hunter’s public statements, including an assertion that the hunter feels “humiliated” and a pledge to release further details in a “bone shattering” drop on July 14, 2026. Both articles also say there are six 0-days in total, with three reported to be under active exploitation, and that more information may follow on the stated date.

The reporting also indicates that Microsoft contacts law enforcement, and that the controversy includes restrictions around public bug-related activity. The included AnandTech-linked discussion notes alleged account and repository bans on platforms such as GitHub and GitLab, alongside claims of termination of a bug-reporting account, though those points are described as allegations rather than confirmed findings.

Across sources, the core points are the claimed number of vulnerabilities, the indication that some are actively exploited, and the escalating public conflict between the hunter and Microsoft, with no shared final determination of the underlying technical facts in the articles.