The researcher who was threatened by Microsoft has just released a seventh Windows zero-day within hours of Patch Tuesday.

      Chaotic Eclipse has released RoguePlanet, their seventh Windows zero-day exploit, just hours after Microsoft’s unprecedented Patch Tuesday, which addressed a record 200 vulnerabilities. This exploit allows attackers to gain SYSTEM privileges on fully updated Windows 10 and 11 systems.

      This researcher, previously threatened with legal action by Microsoft, published the proof-of-concept shortly after Microsoft's June Patch Tuesday update. RoguePlanet takes advantage of a race condition in Windows Defender's internal processing, specifically a Time-of-Check to Time-of-Use (TOCTOU) vulnerability, enabling an unprivileged user to redirect Defender's file operations, which run with SYSTEM privileges, to execute code controlled by an attacker at the highest privilege level.

      The researcher noted, “The exploit is a race condition, so it’s a hit or miss. I have achieved a 100% success rate on some systems while it has had difficulty working on others.” Security firm ThreatLocker has confirmed the exploit's effectiveness and shared a video demonstration, with CEO Danny Jenkins remarking that application allowlisting can mitigate the risk of the exploit executing.

      The proof-of-concept was uploaded to a self-hosted Git repository following the researcher’s claims that Microsoft removed their previous work from both GitHub and GitLab, which has intensified the ongoing dispute. Microsoft has employed its Digital Crimes Unit against the researcher and cut off access to their Microsoft Security Response Center account.

      In just a few months, Chaotic Eclipse has reported seven zero-days: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, and now RoguePlanet. Microsoft’s June Patch Tuesday addressed two of these, GreenPlasma and YellowKey, while the others remain unaddressed. The researcher has stated that these disclosures are a response to Microsoft’s handling of the situation.

      “They treated me poorly and utilized every childish tactic they could,” the researcher expressed. “I began to question if I was dealing with a significant corporation or someone enjoying watching me struggle.”

      The timing is notable; Microsoft’s June Patch Tuesday was its largest to date, resolving 200 vulnerabilities, including 33 rated as critical and three that had been publicly disclosed. Analysts suggest this surge is partly due to AI-assisted code auditing, which is identifying vulnerabilities faster than they can be patched. The emergence of RoguePlanet just hours after such a significant update highlights the ongoing issue: even the largest patch cycle in Microsoft's history was rendered ineffective for users of Windows Defender almost immediately.