Zero-Day Disclosures, Bounties, and GitHub Account Suspensions: The Nightmare-Eclipse Case

The cybersecurity community recently witnessed controversy around vulnerability disclosure ethics when security researcher Nightmare-Eclipse (Chaotic Eclipse) reported that their GitHub account was suspended and removed after publishing zero-day proof-of-concept (PoC) exploits affecting Microsoft products.

📋 The Timeline & Conflict

• The Disclosures: The researcher publicly released working PoC code for unpatched Microsoft vulnerabilities, including the "RoguePlanet" Defender race condition and related system privilege escalation primitives.
• The Dispute: According to a signed statement published by the researcher, prior responsible disclosures to vendor bounty programs allegedly received rejections or zero bounty compensation, leading to public drops.
• The Platform Action: GitHub (owned by Microsoft) suspended the researcher's repository and user account citing terms of service regarding active exploit distribution.

⚖️ The Ongoing Disclosure Dilemma

This incident reignites longstanding debates across the InfoSec ecosystem:

1. Coordinated Disclosure vs. Full Disclosure: Where is the line between pressuring vendors to patch and endangering end-users?
2. Bounty Program Transparency: When researchers invest weeks finding valid vulnerabilities, opaque triage decisions often drive adversarial outcomes.
3. Platform Governance: The tension when a code repository host is owned by the vendor whose software is being researched.

🔗 Statements & References:

• Researcher Statement 1
• Public Statement 2

A pivotal case study in vulnerability coordination, disclosure incentives, and ecosystem trust.