Another unpatched Windows flaw is public, and this one gets Defender to do the dirty work

The researcher known as Nightmare Eclipse has published another one. Abdelhamid Naceri, whose earlier releases included BigDiskBuster, put a working exploit called SignDrop on GitHub this week, and the weakness it uses hasn't been fixed.

SignDrop is what security people call a privilege escalation. It can't get into a PC by itself. What it does is take a program already running with ordinary user rights and hand it SYSTEM, the highest level of control in Windows. The route runs through the Common Log File System, the part of Windows that keeps certain log files, and through protections Microsoft added to it in October 2025. According to SecurityWeek, the exploit gets Microsoft Defender to create a signature file in a place the attacker chooses. Defender does that with full system rights, and the exploit then slips its own payload into the file. Naceri also claims the same technique can switch off the self-protection that antivirus programs use to stop malware tampering with them.

Naceri tested it on Windows 11 26H2 and estimates that about 80% of Windows installations are vulnerable, a figure neither BleepingComputer nor SecurityWeek has checked. Cyderes, a security firm that compiled and ran the code, says it has seen no evidence of SignDrop being used in real attacks. There's no fix, and Naceri says disabling the log file protection would only reopen older holes, so leave the registry alone. Don't download the proof-of-concept to "test" your own PC either.

The useful defence is the boring one. A bug like this needs a foothold first, usually a program someone was talked into running, so the cracked game, the fake browser update and the video "codec" a website insists you need remain the real danger. Keep Windows Update switched on so the patch arrives the day Microsoft ships it, and let Tendvane's security check confirm at a glance that Defender, the firewall and updates are all in order.