BigDiskBuster Exploit Blocks Microsoft Defender Updates on All Supported Windows Versions
Security researcher Abdelhamid Naseri, operating under the alias Nightmare Eclipse, has published a new exploit called BigDiskBuster that targets Microsoft Defender. The tool blocks updates to both the Defender platform and its antivirus signatures, leaving Windows systems reliant on an already-installed and increasingly outdated threat database.
BigDiskBuster affects all supported versions of Windows but must remain running continuously in the background to maintain its effect. Naseri has stated that the current implementation contains bugs and requires additional development. The full source code has been made available on GitHub.
The new technique is similar to UnDefend, another tool released in April that also prevented Microsoft Defender from obtaining updates. The core risk is that the antivirus appears fully operational in the user interface while its signature base gradually becomes obsolete, increasing the chance of missing newer threats.
BigDiskBuster represents the latest in a series of public disclosures by Naseri targeting Windows components. Since April the researcher has released nearly a dozen proof-of-concept exploits affecting Microsoft Defender, BitLocker, and other system elements. These include ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and multiple Plasma variants.
Microsoft has patched some of the disclosed issues but has not yet released fixes for several others. The company has previously criticized the publication of working exploits without prior coordination, warning that such releases create unnecessary risk for users and may lead to legal action if real harm occurs. At the time of writing, Microsoft has not commented on BigDiskBuster or confirmed an available remediation.
Administrators are advised to monitor the actual success of Microsoft Defender signature updates rather than relying solely on the green status indicator in the interface.
Related articles
ZeroNights 2026 Conference Program Highlights Offensive Security Research Across 30+ Talks
The ZeroNights 2026 conference program has been announced, featuring three tracks, four stages, and over 30 speakers focused on advanced offensive techniques, vulnerability discovery, and secure development practices. The event will take place on September 30, 2026, in Saint Petersburg at LOFT#7. Key presentations on the Offensive Track cover femtocell security, mobile operator advertising API exploitation, Trusting Trust attacks on the JDK, Rust memory safety limitations, and AMD SMM vulnerabilities including CVE-2025-54502. Additional talks examine Qualcomm BootROM flaws such as CVE-2026-25262, Linux kernel exploitation via CVE-2026-31695, Semtech LR11xx chip vulnerabilities, and reverse engineering of Dexprotector. The program emphasizes practical research into binary exploitation, side-channel analysis, and cross-chain bridge attacks.
WordPress Click2Shell Flaw Chain Lets Attackers Achieve RCE via Single Admin Click
Researchers discovered a chain of vulnerabilities in WordPress core named Click2Shell that enables remote code execution without attacker authentication. The attack requires only that a logged-in administrator opens a specially crafted preview link, after which the interface automatically installs a malicious theme. Researcher Paulos Yibelo from pwn.ai found that inconsistent parameter handling between the theme directory API and browser JavaScript allowed the crafted URL to trigger installation without user interaction. A second vulnerable component, the Mobile Repair Zone 2.5.4 theme from the official directory, was used to load arbitrary PHP code and abuse an insecure AJAX handler for plugin installation. Successful exploitation grants full access to wp-config.php, database credentials, file modification rights, and the ability to create new administrators. WordPress addressed the issue in version 6.7.1 and backported fixes to supported branches, while the constant DISALLOW_FILE_MODS offers temporary mitigation by blocking theme and plugin changes.
Cache Key Injection Flaw in Nginx Configurations Allows Access Bypass, Data Disclosure and Cached Denial of Service
Security researcher Alex Brumen from YesWeHack has detailed a Cache Key Injection attack vector that exploits poorly constructed cache keys in Nginx. The issue arises when administrators concatenate variable-length values without delimiters, such as $scheme$host$request_uri$http_accept, allowing different requests to produce identical cache keys. Attackers can poison the cache with 404 responses to deliver CPDoS, expose restricted pages like /admin by manipulating path components, or even achieve stored XSS by colliding HTTP and HTTPS responses. The technique can also bypass Cloudflare protection when the Authorization header routes requests directly to the vulnerable Nginx cache. Mitigation requires using explicit delimiters or structured encoding in cache keys, validating the Host header, enforcing HTTPS redirects, and avoiding caching of authenticated requests.
Click2Shell Flaw in WordPress Core Enables Remote Code Execution via Single Malicious Link
Researchers at pwn.ai have disclosed Click2Shell, a vulnerability in the WordPress core that allows an attacker to install a malicious theme and achieve remote code execution simply by tricking an authenticated administrator into opening a crafted link. The isolated flaw carries a CVSS score of 7.1, but the full attack chain reaches 9.6. The issue stems from an interpretation mismatch between the WordPress.org theme directory and the administrator browser, causing the browser to automatically trigger the install button without any user confirmation or password prompt. Affected versions start from 6.0 and run up to but not including 7.1.1. The vulnerability has been fixed in WordPress 7.1.1 with backported patches released for all supported branches down to version 4.7. No exploitation in the wild had been observed at the time of disclosure, yet the low barrier of convincing an admin to click a link makes prompt patching essential.