New Windows Defender zero-day blocks Microsoft antivirus updates

What happened

Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates. [...]

Why it matters

The incident may affect operational continuity, asset safety or trust around Microsoft. Watch for verified scope and remediation.

Affected entities

View evidence

4 reports · 1 original report · 2 independent

1. BleepingComputerPrimary source · Supports · EN · 100%
   New Windows Defender zero-day blocks Microsoft antivirus updates ↗Sep 22, 2026, 5:55 AM
2. BleepingComputerPrimary source · Supports · EN · 50%
   EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts ↗Sep 22, 2026, 11:00 AM
3. The Hacker NewsIndependent · Supports · EN · 50%
   SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE ↗Sep 22, 2026, 7:17 AM
4. The Hacker NewsIndependent · Supports · EN · 67%
   Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates ↗Sep 22, 2026, 12:14 PM

Claims

• New Windows Defender zero-day blocks Microsoft antivirus updates Observed

Conflicts

No material conflict detected in the available evidence.

Timeline

1. September 22, 2026 at 5:55 AMFirst reported
2. Sep 22, 2026, 8:01 AMUnverified · 85/66%

Market move following event

Market reaction is not yet available for this asset and time window.

Score explanation