Dead Eclipse
deadeclipse666.blogspot.com · Personal blog · on HN since 2026
An anonymous security researcher, also called Nightmare Eclipse, publishes Windows exploit disclosures and posts angry about Microsoft.
What HN saysCommenters link it as the source for recent Windows zero-day releases, including a BitLocker bypass, claims of a TPM+PIN exploit, and the author's bans.
16HN people shared it
9linked it in comments
7stories submitted
10story points
5 months agolast shared
2026people per year2026
Most-shared posts
- 1June 9. Dead man switch and MS RCE drops promised?3 people · 2 points · first shared 2026 · 1 comments on HN
- 2Were doing silent patches now huh also3 people · first shared 2026
- 3Two more public disclosures, it will never stop2 people · 1 points · first shared 2026 · discussion on HN
- 4Were doing silent patches now huh also2 people · first shared 2026
- 5MiniPlasma, a Powerful LPE1 people · 2 points · first shared 2026 · discussion on HN
- 6Disclosing bluehammer exploit, vulnerability is still unpatched1 people · 2 points · first shared 2026 · discussion on HN
- 7Nightmare Eclipse: RoguePlanet Windows Defender race condition to SYSTEM shell1 people · 1 points · first shared 2026 · discussion on HN
- 8Angry security researcher declares Bitskrieg on Microsoft1 people · 1 points · first shared 2026 · discussion on HN
- 9MiniPlasma, a Powerful LPE1 people · 1 points · first shared 2026 · 1 comments on HN
- 10July 14th1 people · first shared 2026
- 112026 041 people · first shared 2026
What HN people wrote when they linked it
daniel_j · 2026-06-10
This is by the same person who released the recent bitlocker exploit (YellowKey) and other recent zero day exploits. I assume this GitHub account will soon be banned as well, just like his GitLab was. He is now hosting his git on another server.
https://deadeclipse666.blogspot.com/
https://git.projectnightcrawler.dev/NightmareEclipse
embedding-shape · 2026-05-29
> And where's the claimed version that works when a PIN is set?
Maybe it was on GitHub/GitLab before the author was banned by both Microsoft and GitLab, not really sure we'd know. The authors last post on their blog is from yesterday (28th of May, https://deadeclipse666.blogspot.com/) so seems they aren't fully gone. But yeah, been a lot of "promises" but besides the initial 0days, not so much released AFAIK.
thewebguyd · 2026-05-29
He's claimed that he has more as well. He seems to have a personal vendetta against Microsoft going by his blog, said nothing will be released in June but will in July: https://deadeclipse666.blogspot.com/2026/05/july-14th.html
dataflow · 2026-05-17
They claim they have TPM + PIN exploit too, though how credible it is remains to be seen.
https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-…
pajko · 2026-05-15
... who converted Windows 11 into Emmentaler: https://deadeclipse666.blogspot.com/2026/04/
anonymars · 2026-05-14
andrecarini · 2026-05-14
The exploit developer themselves say [1] TPM+PIN is vulnerable, though no public PoC.
[1]: https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-…
otterley · 2026-05-14
Here's the primary source: https://deadeclipse666.blogspot.com/2026/05/two-more-public-disclosure…
Other links:
https://github.com/Nightmare-Eclipse/YellowKey
https://github.com/Nightmare-Eclipse/GreenPlasma
ndiddy · 2026-05-14
The author claims the exploit also works with TPM+PIN, he just hasn't released the PoC:
> Second thing is, No, TPM+PIN does not help, the issue is still exploitable regardless, I asked myself this question, can it still work in a TPM+PIN environment ? Yes it does, I'm just not publishing the PoC, I think what's out there is already bad enough.
https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-…