Security researcher claims to have additional zero-day exploits following public disagreement with Microsoft over vulnerability disclosure
- Security researcher threatens to release Windows exploits on July 14 following dispute with Microsoft
- Researcher claims to possess six zero-day vulnerabilities, with three allegedly under active exploitation
- Microsoft has reportedly contacted law enforcement regarding the researcher’s threats
A security researcher has threatened to release additional Windows exploits on July 14, escalating a public dispute with Microsoft over vulnerability disclosure practices. The Register reports the researcher claims to possess six zero-day vulnerabilities, with three allegedly under active exploitation.
The researcher described feeling “humiliated” by Microsoft and promised what they termed a “bone shattering drop” of exploits. Microsoft has reportedly contacted law enforcement regarding the threats, according to the publication.
The dispute appears to centre on disagreements over Microsoft’s handling of vulnerability disclosures and researcher communications. The researcher’s claims about possessing multiple zero-day exploits and plans for future releases represent an escalation in the ongoing conflict.
The threatened July release date suggests the researcher is operating on a predetermined timeline, potentially giving organisations time to prepare defensive measures if the threats materialise.
Why It Matters
This situation represents a significant risk management challenge for CISOs running Windows environments. The researcher’s claims about possessing exploits for vulnerabilities under active exploitation suggest immediate security concerns that may require emergency patching protocols.
The public nature of this dispute and the specific threat timeline creates an unusual scenario where organisations have advance warning of a potential exploit release, allowing for proactive security measures and board-level risk communication.
What To Do Now
- Monitor Microsoft security advisories for any emergency patches related to this situation
- Review Windows patch deployment procedures and ensure rapid deployment capabilities are operational
- Assess current Windows environment exposure and prioritise critical systems for additional monitoring
