New Windows Defender zero-day blocks Microsoft antivirus updates September 22, 2026 Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates. Naceri named it BigDiskBuster and said it is similar to another Defender zero-day known as UnDefend, which he released in April and that allowed standard users to block definition updates. The security researcher added that BigDiskBuster works on all supported Windows versions and that it needs to run in the background to block Defender updates. "Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background," he said . "This proof of concept is similar to UnDefend, it prevents windows defender from performing platform/signature updates. Seems to work on all supported windows versions but PoC is a bit buggy and needs some rewritting but you get the idea." Since April 2026, Naceri, who claims to be a former Microsoft employee, has released almost a dozen zero-day exploits as part of an ongoing dispute with Microsoft over their alleged unfair termination in March 2025 . Naceri also released several zero-day exploits that allowed privilege escalation on various Windows versions five years ago. Two weeks ago, they released another Defender zero-day exploit that grants SYSTEM access (known as ' ShieldCrash ') right after Microsoft rolled out this month's Patch Tuesday security updates. According to Naceri, ShieldCrash bypasses another ShieldBreak Defender privilege escalation flaw patched a week earlier , which itself bypassed RoguePlanet , another Defender flaw the security researcher disclosed in June and Microsoft patched in July . Naceri's zero-day exploits released this year also include LegacyHive , BlueHammer , RedSun , YellowKey , GreenPlasma , MiniPlasma , and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components. Microsoft initially responded with warnings of legal action against anyone engaging in "malicious activity causing real harm" to the company's customers, leading many in the infosec community to believe that Microsoft was directly threatening the security researcher. While Microsoft has fixed some of the security flaws Naceri disclosed (such as ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma flaws), the other security issues still lack an official patch. A Microsoft spokesperson was not immediately available to comment when BleepingComputer reached out about the BigDiskBuster denial-of-service zero-day. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Microsoft fixes known issue causing Windows Defender crashes Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts Microsoft asks users to ignore 'Antivirus is turned off' errors Microsoft working on Defender patch for ShieldBreak zero-day New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access Denial of Service Microsoft Defender

Microsoft Defender Antivirus Windows Defender Previous Article ThomasMann - 13 hours ago Now that is my kind of guy.... Now that is my kind of guy.... IhateMicroSoft - 10 hours ago Did anyone else notice his X page is gone??? MSNightmare2000 returns Hmm...this page doesn’t exist. Try searching for something else.. Did anyone else notice his X page is gone??? MSNightmare2000 returns Hmm...this page doesn’t exist. Try searching for something else.. Not a member yet? Register Now You may also like: Researchers escape OpenAI Codex sandbox to run commands on host Researchers escape OpenAI Codex sandbox to run commands on host Malicious npm packages evade install-script defenses at runtime Malicious npm packages evade install-script defenses at runtime Microsoft reminds admins to migrate Entra ID users to passkeys Microsoft reminds admins to migrate Entra ID users to passkeys Automate Onboarding and Access Reviews with No-Code IGA: See how it works Automate Onboarding and Access Reviews with No-Code IGA: See how it works Build cyber resilience with Wazuh: The open-source SIEM & XDR for proactive protection Build cyber resilience with Wazuh: The open-source SIEM & XDR for proactive protection Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report. Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report.