For three months, a single researcher has been publishing Windows exploits faster than most people can keep track of, and some of them worked on fully up-to-date machines. It is a good moment to say out loud the uncomfortable thing underneath the headlines: patching, on its own, is not a security strategy.
What happened
A researcher operating as "Nightmare Eclipse," reportedly a former Microsoft security employee, has released seven public Windows zero-day proof-of-concepts since April 2026, as part of an open and very public feud with Microsoft over how it handles vulnerability disclosure and bug bounties. The most recent, nicknamed RoguePlanet (CVE-2026-50656), abuses a timing flaw in Microsoft Defender to hand an attacker complete SYSTEM-level control of a machine, and it was demonstrated against fully patched Windows 11 and Windows 10. To its credit, Microsoft has been closing these as they appear, RoguePlanet was fixed on July 9, but the steady drumbeat is the real story.
What a "zero-day" actually means
The term gets thrown around, so it is worth being clear. A zero-day is a flaw that is known and exploitable before the vendor has a fix available. For that window of time, being fully up to date does not protect you, because the patch does not exist yet. That is what makes these uncomfortable: the usual advice, "keep everything updated," is necessary but cannot help with a hole that has no update.
One honest bit of reassurance: most of these particular bugs are privilege-escalation flaws. They do not, by themselves, get an attacker onto your machine; they let an attacker who already has a limited foothold turn it into total control. That matters, because it tells you where the defense actually lives.
Why this matters for a small business
- Patching is necessary but not sufficient. It closes the known holes. It does nothing for the unknown ones, or for the gap before a fix ships.
- The damage lives in privilege. Because these turn a small foothold into full control, the single most useful defense is not leaving standing administrator rights lying around to be grabbed.
- You will not out-patch a determined attacker. The realistic goal is not a perfect wall; it is making sure no single flaw is enough on its own.