Nightmare Eclipse, who dropped RoguePlanet in June and ShieldBreak in August, has published proof-of-concept code that reads any file with System privileges on fully patched Windows, inside the same month as Microsoft's September 3 fix.
Perspective Coverage
17 publishers
- Builder
- Builder 9%
- Operator
- Operator 82%
- Investor
- Investor 9%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+45
- Incentives60
- Confidence50
Six 10.0s in the control plane, and nothing in your patch queue to show for it
Microsoft shipped 22 updates, six of them scored 10.0, mostly in Entra ID, Exchange Online and Azure. Fixed server-side is not the same as verified in your tenant.
Reality
- Evidence58
- Adoption55
- Hype gap0
- Incentives
- Not scored
- Confidence52
buildOne report1 publisher ShieldCrash still reads SYSTEM files on Windows hosts that took September's full update
ShieldCrash, a public proof of concept, reaches SYSTEM-level file reads on fully patched Windows hosts, defeating Microsoft's fix for CVE-2026-69414. Only arbitrary read has been shown, not code execution, and there is no confirmed exploitation in the wild.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap0
- Incentives40
- Confidence40
buildOne report1 publisher BigDiskBuster reserves the last free bytes on C: to make Defender updates fail
The public proof-of-concept watches Defender's update directories, hoards nearly all the free space on C: with delete-on-close files, and hands the space back once the update has already failed. At rest, the disk looks normal.
Reality
- Evidence36
- Adoption12
- Hype gap+34
- Incentives
- Not scored
- Confidence42
buildConfirmed2 publishers Microsoft's September release addressed 972 CVEs, the largest count it has ever shipped. Within hours a researcher published a working proof-of-concept against CVE-2026-69414, the second fix for a Defender flaw first patched in July.
Reality
- Evidence48
- Adoption45
- Hype gap+22
- Incentives55
- Confidence52
Kaspersky's CVE surge has two sources, and only one of them lands in the CVE count
Kaspersky's Q2 2026 figures credit AI with both writing the bugs and finding them. The disclosures carrying working exploit code never got a CVE identifier at all.
Reality
- Evidence48
- Adoption44
- Hype gap+30
- Incentives66
- Confidence45
buildOne report1 publisher A researcher is timing zero-days to Patch Tuesday, and the monthly cadence has no reply
Ten drops since April 2026, the latest handing any local user SYSTEM on fully patched Windows 11. The next scheduled fix can be 28 days out, so mitigation has to be a day-one job.
Reality
- Evidence32
- Adoption36
- Hype gap+18
- Incentives48
- Confidence34
Two years, 117 identified children: the only Com case this week with an outcome attached
A UK sentencing is the week's single security item measured in results rather than warnings, and the arithmetic is unflattering: 730 days of custody against 117 identified victims.
Reality
- Evidence52
- Adoption63
- Hype gap+18
- Incentives58
- Confidence46