We have been writing about Chaotic Eclipse, the researcher who goes by Nightmare Eclipse, since April 17, 2026. We wrote about BlueHammer — a TOCTOU race condition in Defender's malware cleanup engine, CVSS 7.8, SYSTEM-level privilege escalation on fully patched Windows 10 and 11 — the day it dropped. We wrote on June 5 that Microsoft's response to that disclosure was to ban the researcher from its own GitHub and refer him to its Crimes and Security Team, which cybersecurity

Yesterday the IRGC named 18 American companies as military targets. Today we went hunting on GitHub for the exploit code that's already being staged against them. We found webshells disguised as security research. Full exploitation toolkits published the day before CISA deadlines. Java GUI "exploit tools" committed with debug logs. And nobody paying attention. This is the wasteland. The space between a CVE disclosure and a patch deployment where attackers stage their tools in

The Man Who Claimed Los Angeles, Chicago, and Now Minneapolis Has a Pattern. We Have Receipts.