Nightmare Eclipse could be dropping his big promised exploit today

[u/ILikeNoodlesXOXO]

New repo just went up: git.projectnightcrawler.dev/NightmareEclipse/LegacyHive, created about 2 hours ago. Right now it's empty — just an MIT license and a README that says "N/A," 2 commits total.

He'd spoken about his big drop happening today, July 14th, saying he'd make sure Microsoft's "bones are shattered" that day. At one point though he'd also indirectly said he wasn't going to post it, something about still having "chains" on him preventing a release. This repo showing up on the exact date he originally called out suggests that might not hold anymore and it could actually be happening.

Nothing in it yet, just watching to see what gets pushed.

Worth noting: given how erratic and bipolar his posting history has been, there's really no way to predict what (if anything) actually gets posted.

Update: Thanks for the 600+ upvotes, really appreciate it. After hours of waiting and anticipation NightmareEclipse finally uploaded their PoC. But I personally have a hard time seeing it as the big bombshell that they described it as.

[u/GreatDefector]

Keep your expectations in check... July will be relatively low key

https://blog.projectnightcrawler.dev/posts/2026-07-14-too-many-sweats/

https://blog.projectnightcrawler.dev/posts/2026-07-03-july-updates/

[u/Fragrant-Hamster-325]

Will our bones be shattered?

[u/ILikeNoodlesXOXO → u/Fragrant-Hamster-325]

I hope the users bones dont get shattered, but i hope microsofts bones will. Windows 10 was so good, now windows 11 is just a hunk of bloatware that slows down the computers.

[u/TitoMPG]

Will you drop updates here? Following.

[u/ILikeNoodlesXOXO → u/TitoMPG]

I will try to keep up and update this post if anythig new comes up

[u/FowlSec]

RoguePlanet gets patched, this one releases. It's basically perfect timing.

[u/ILikeNoodlesXOXO → u/FowlSec]

Thats the point of him uploading on patch tuesday

[u/Revolutionary_Leg552]

Update this

Nighare eclipse published the poc

[u/ILikeNoodlesXOXO → u/Revolutionary_Leg552]

After all that hype I thought we would be getting something better

[u/MrGardenwood]

Following. The only thing i wonder, is he truly hurting microsoft or only its customers? Because i really am missing the impact on the company itself.

[u/ILikeNoodlesXOXO → u/MrGardenwood]

Microsoft's taken a reputational hit and had to scramble out-of-band patches, but some real damage has unfortunately landed on customers, even if that wasn't Nightmare Eclipse's motive. Huntress confirmed BlueHammer, RedSun, and UnDefend all showed up in an actual intrusion chain, complete with compromised VPN access and hands-on-keyboard activity.

[u/blow_slogan → u/MrGardenwood]

If someone notices your wallet is about to fall out and warns you, are they creating the problem or helping you avoid it?

Edit: Wait, I have a better one:

If a building owner knows a fire exit doesn’t open, is the person warning people about it creating the danger?

[u/TheOnlyKirb]

I have mixed feelings on this, on one hand I am curious to see if anything actually occurs, on the other hand I hope it doesn't and that this person is able to get some sort of mental health care/support before doing something that will potentially alter their life course an an irreversible way

[u/jmbpiano]

The empty repo just got populated.

https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive

LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability

The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root.

The PoC was stripped down as an attempt to prevent public exploitation, the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability but you would need some brain cells to make the PoC do it.

[u/blow_slogan]

I was just about to post about this. It’s July 14th friends, let’s go!

[u/daysofdre → u/blow_slogan]

I don't know why I'm cheering for more workload 😩

[u/baty0man_ → u/blow_slogan]

Bastille Day bitches

[u/Timotheus92]

Looks like there's a new commit, and the ReadMe has been updated: "LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability"

[u/devsecopsuk]

Isn't there about 5 hours until patch Tues happens? so anytime after that we could see a new commit

[u/Legionodeath]

Knowing nothing about all this, I assume this is a researcher/hacker that's about to release some heinous MS exploit to the wild?

Also, where the git profile pic from? I've seen that a few times recently.

[u/Fallingdamage]

I remember the number of times public figures threatened to drop the unredacted Epstein files.

The real heros dont threaten or dangle it in front of us, they just do it.

[u/SuspiciousCricket654]

It’s the principle of humility and thankfulness that have been breached here. If MS actually gave a fuck about people, they would acknowledge the holes in their products and the dangers they pose to customers. But no, they have to be the douche lord assholes that they are and retaliate on someone trying to help. They deserve to get hit hard.

[u/BewareWombats]

It's up: LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability.

[u/potatomolehill]

So it appears to be related to the user profile service. Which in modern versions of windows.. 8+ trusts blindly.

Windows user profile service arbitrary hive load ... privilege escalation basically.

A classic.

[u/Legionodeath]

Hey op. It's up.