A day after Microsoft patched it, someone published proof the patch was incomplete

Microsoft spent Tuesday shipping the largest set of security fixes in its history. On Wednesday, an anonymous researcher published evidence that one of them did not finish the job.

The tool is called ShieldCrash and it targets Microsoft Defender, the antivirus built into Windows. Its predecessor, ShieldBreak, was tracked as CVE-2026-69414 and closed in Malware Protection Engine version 1.1.26080.3. The researcher's claim is blunt: Microsoft blocked several routes to the flaw and missed one. What is left reads arbitrary files with SYSTEM privileges on Windows 10, Windows 11 and Windows Server, fully updated, with no fix available. They describe this release as a basic version and say a full SYSTEM exploit is achievable.

Before you go hunting for something to switch off, the shape of this matters. ShieldCrash reads files; it cannot write them. And like the RoguePlanet flaw we covered in July, it is a local escalation, which means it is only useful to something already running on your machine. Nobody catches this from a web page or an email. It is the second move in an attack, not the first.

The context is what makes it unusual. Since April the same person, who posts as Nightmare Eclipse and Chaotic Eclipse among other names, has released a string of Windows and Defender zero-days: ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma and UnDefend, in an open dispute with Microsoft over how it handles bug reports and bounties. Microsoft has answered with warnings of legal action over "malicious activity causing real harm". Home users are bystanders to that argument, which is an uncomfortable place to be standing.

So there is nothing to install and nothing to disable. The fix, when it comes, will arrive through Defender's own engine updates rather than Windows Update, so the useful habit is simply making sure Defender is running with Tamper Protection on. Tendvane's security-posture check confirms exactly that, which is worth a look if something you installed months ago has been quietly turning protection down.