How does it bypass the patch?

ShieldBreak is not an unrelated new bug — it is a direct patch bypass. The researcher stated that Microsoft "failed to properly patch the RoguePlanet vulnerability," and the PoC demonstrates a full circumvention of the July fix . Rather than introducing a different exploit class, ShieldBreak reportedly defeats the exact mitigation Microsoft shipped five weeks earlier .

Who released it?

The exploit was released by a security researcher using multiple aliases: Nightmare Eclipse, Chaotic Eclipse, INFINITE NIGHTMARE, and MSNightmare . This is the researcher's ninth publicly released Windows zero-day exploit .

Systems affected

ShieldBreak affects fully patched Windows 10 and Windows 11 systems running the July 2026 updated version of the Microsoft Defender Malware Protection Engine . Because it is a patch bypass, any system that applied the July fix for CVE-2026-50656 — and no further mitigation — remains exposed.

Broader context: the months-long dispute

Nightmare Eclipse and Microsoft have been locked in a public confrontation over vulnerability disclosure for months:

• The researcher has repeatedly released zero-day PoCs hours after Microsoft's Patch Tuesday updates, timing releases to maximize pressure .
• In May 2026, Microsoft blocked the researcher from GitHub and GitLab, and published a blog post calling out the researcher's behavior. The researcher responded by threatening to release additional zero-days .
• Microsoft characterized the releases as irresponsible disclosure; the researcher argued that Microsoft was slow to patch reported flaws and that public pressure was the only effective lever .
• The Register reported on July 9, 2026 that Microsoft had "quietly fixed" RoguePlanet, "closing the latest hole exposed by security researcher Nightmare Eclipse after months of public sparring" . ShieldBreak, released just over a month later, suggests the dispute is ongoing.

August 2026 Patch Tuesday (August 11, 2026)

Microsoft's August 2026 Patch Tuesday addressed approximately 400–418 vulnerabilities (counts vary by source), including 62 critical severity flaws and three zero-days .

Actively exploited zero-day: CVE-2026-68820

• Component: Windows Ancillary Function Driver for WinSock (afd.sys), a kernel-mode driver that handles socket operations for nearly all networked Windows processes .
• Type: Use-after-free vulnerability .
• Severity: Important (CVSS score unavailable in sources, but classified as Important / Elevation of Privilege) .
• Status: Actively exploited in the wild at the time of patching .

Two additional AFD.sys privilege-escalation bugs were also fixed: CVE-2026-61348 and CVE-2026-70307 . Microsoft's August release followed July 2026's record-breaking 570-patch Patch Tuesday and June 2026's ~200-patch cycle .

How does it bypass the patch?

ShieldBreak is not an unrelated new bug — it is a direct patch bypass. The researcher stated that Microsoft "failed to properly patch the RoguePlanet vulnerability," and the PoC demonstrates a full circumvention of the July fix . Rather than introducing a different exploit class, ShieldBreak reportedly defeats the exact mitigation Microsoft shipped five weeks earlier .

Who released it?

The exploit was released by a security researcher using multiple aliases: Nightmare Eclipse, Chaotic Eclipse, INFINITE NIGHTMARE, and MSNightmare . This is the researcher's ninth publicly released Windows zero-day exploit .

Systems affected

ShieldBreak affects fully patched Windows 10 and Windows 11 systems running the July 2026 updated version of the Microsoft Defender Malware Protection Engine . Because it is a patch bypass, any system that applied the July fix for CVE-2026-50656 — and no further mitigation — remains exposed.

Broader context: the months-long dispute

Nightmare Eclipse and Microsoft have been locked in a public confrontation over vulnerability disclosure for months:

• The researcher has repeatedly released zero-day PoCs hours after Microsoft's Patch Tuesday updates, timing releases to maximize pressure .
• In May 2026, Microsoft blocked the researcher from GitHub and GitLab, and published a blog post calling out the researcher's behavior. The researcher responded by threatening to release additional zero-days .
• Microsoft characterized the releases as irresponsible disclosure; the researcher argued that Microsoft was slow to patch reported flaws and that public pressure was the only effective lever .
• The Register reported on July 9, 2026 that Microsoft had "quietly fixed" RoguePlanet, "closing the latest hole exposed by security researcher Nightmare Eclipse after months of public sparring" . ShieldBreak, released just over a month later, suggests the dispute is ongoing.

August 2026 Patch Tuesday (August 11, 2026)

Microsoft's August 2026 Patch Tuesday addressed approximately 400–418 vulnerabilities (counts vary by source), including 62 critical severity flaws and three zero-days .

Actively exploited zero-day: CVE-2026-68820

• Component: Windows Ancillary Function Driver for WinSock (afd.sys), a kernel-mode driver that handles socket operations for nearly all networked Windows processes .
• Type: Use-after-free vulnerability .
• Severity: Important (CVSS score unavailable in sources, but classified as Important / Elevation of Privilege) .
• Status: Actively exploited in the wild at the time of patching .

Two additional AFD.sys privilege-escalation bugs were also fixed: CVE-2026-61348 and CVE-2026-70307 . Microsoft's August release followed July 2026's record-breaking 570-patch Patch Tuesday and June 2026's ~200-patch cycle .