GitHub Bans Security Researcher for Windows Vulnerabilities

Independent security researcher Nightmare-Eclipse (pseudonym Chaotic Eclipse) reported that Microsoft blocked his GitHub account. While the exact reasons remain undisclosed, the expert claims the company deleted his Microsoft account used for submitting vulnerability reports. He has since moved his work to GitLab.

In a blog post, Eclipse accuses Microsoft of retaliation, stating the company not only refused dialogue but also failed to pay promised bounties for disclosed vulnerabilities. Microsoft’s Security Response Center (MSRC) program offers up to 18 млн ₽ for critical vulnerabilities, such as those in Hyper-V. However, the researcher claims he received no compensation despite publishing six Windows exploits.

The situation is further complicated by the fact that some of Eclipse’s disclosed vulnerabilities are already being exploited by threat actors. These include BlueHammer (privilege escalation via Defender), RedSun, UnDefend (Disabling Defender), GreenPlasma (exploiting CTFMon), and YellowKey (bypassing BitLocker encryption). The expert has threatened to release new exploits on July 14, calling it 'retaliation' against Microsoft’s actions.

Other cybersecurity professionals, including William Dormann from Tharros, note that MSRC’s policies have shifted: the company now requires video proof of exploits, and qualified staff have been laid off as part of restructuring. This raises concerns about transparency in vulnerability disclosure and the effectiveness of researcher engagement.

The GitHub account ban has drawn criticism toward Microsoft, as such measures fail to address security concerns and instead exacerbate conflicts. With the time between vulnerability discovery and exploitation shrinking, experts urge companies to rethink their approaches to collaborating with researchers.