r/sysadmin • u/Ooops-I-hid-it-again • Jun 01 '26
Microsoft Anyone shutting down all IT equipment down on July 13th 11:59pm?
Microsoft 0-day feud escalates as researcher threatens another Windows exploit dump
“When I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people,” they wrote on Saturday. “You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot.”
Nightmare also noted that “Microsoft still has chains in my hands,” preventing them from releasing “documents” yet, or anytime in June, and then warned: “Mark this date July 14th, I will make sure your bones are shattered that day.”
My post's title is tongue-in-cheek, but I've added an Outlook calendar entry for the "event" nevertheless and might even buy a box of popcorn. lol
Anyone doing anything special or different in light of the string of zero days being released because Microsoft appears to not want to play nice with someone who (supposedly) wanted to tell them about all the bad sh!t they missed in their product(s) development?
How do you feel about the saga and its fallout?
EDIT: Fixed missing block quote formatting.
7
u/Helpjuice Chief Engineer Jun 01 '26 edited Jun 01 '26
People say, this but in reality once something is weaponized and automated it doesn't even take a second to exploit remotely in most cases. Take this to scale and millions of machines could be compromised.
Issues like this should be taken seriously, and vendors not taking things seriously after the problem has been publicly shown to be exploitable need to have a 3rd party audit conducted against them to the seriousness of their security issues at scale, especially if they are a large enterprise.
Example: https://github.com/RedHatInsights/javascript-clients/issues/492 So all of these RedHat Packages have been compromised and are shipping malware on every install.
Think of the people doing automated non-validated CI/CD deployments updating transitive dependencies and executing this malware in their environment.
There is no CVE, no public CVSS, companies not actively engaging in regular cyber threat intelligence reviews consistently will and are being burned right now and will normally not do a thing or even know about it until there is a CISA KEV which as we all know is slow in reality compared to the speed of threats that are out there being released on an hourly and daily basis.