Security researcher **Chaotic Eclipse**, also known as **INFINITE NIGHTMARE**, **MSNightmare**, and **Nightmare-Eclipse**, has publicly released proof-of-concept (PoC) exploits for new privilege escalation flaws. The latest disclosures target leading endpoint security solutions, raising concerns for IT security professionals. ## FalconFlank: Exploiting CrowdStrike Falcon The first of the newly revealed zero-days is dubbed **FalconFlank**. This PoC demonstrates a privilege escalation vulnerability within **CrowdStrike Falcon Sensor**, specifically by abusing the product's remediation process for malicious **Microsoft Office** macros. According to the researcher's **GitHub** README, "FalconFlank is a 0-day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor." They suggest that **CrowdStrike** may already have detections in place, advising testers to either add exclusions or obfuscate the PoC. The exploit has been confirmed to work on fully updated **Windows 11 25H2** and **Windows Server 2025** machines running **CrowdStrike Falcon**. **CrowdStrike** has acknowledged the report and is actively investigating. A spokesperson stated, "We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal." ## HardBreacher: Targeting Kaspersky Endpoint Security Days prior to the **FalconFlank** disclosure, **Chaotic Eclipse** also released a PoC for **HardBreacher**, a privilege escalation flaw affecting **Kaspersky's** endpoint security product for Windows (version 14.0.0.504). The researcher described the PoC as "not in the best shape at all, it is basically duct tapped," noting it might require multiple attempts to succeed. If successful, it creates a file `C:\Windows\System32\MY_SNAKE_IS_SOLID.dll` with full permissions for the current user. The researcher emphasized the severity, stating, "Kaspersky completely loses it when you take control over the UI process, you can cause it to stop functioning, grant/block access to files it's not supposed to, if the PoC succeeds, the entire operating system becomes a hot mess." **Kaspersky** has since confirmed that the **HardBreacher** issue has been resolved. "The corresponding fix is delivered via an automatic update, or users can trigger database update manually," the company stated. ## Lingering Concerns: Microsoft Defender's ShieldBreak These recent disclosures follow **Chaotic Eclipse's** publication last month of **ShieldBreak**, a zero-day PoC for **Microsoft Defender** (aka **CVE-2026-69414**). **ShieldBreak** allows an attacker to execute arbitrary code with `NT AUTHORITY\SYSTEM` privileges and is assessed as a patch bypass for **CVE-2026-50656** (aka **RoguePlanet**). **Microsoft** has yet to release a fix for **ShieldBreak**. **LevelBlue** elaborated on the exploit's mechanics, stating, "ShieldBreak combines Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation, and a timing race in the remediation path. The result is a self-contained local privilege escalation chain in which Windows Defender's own clean engine is redirected to write an attacker-supplied DLL to `C:\Windows\System32\phoneinfo.dll`, followed by SYSTEM execution through the built-in Windows Error Reporting task." The researcher has publicly expressed frustration with **Microsoft**, alleging the company has ceased communication and is "trying hard to paint me as some insane criminal." They claimed that restrictions imposed by **Microsoft** prevent them from reporting bugs to other vendors, leading them to consider publishing vulnerabilities for third-party products during the window before **Patch Tuesday**.