Microsoft is threatening legal action for disclosing exploits

Microsoft is facing criticism for its handling of zero-day exploits. Nightmare Eclipse has publicly posted proof-of-concept exploit code, claiming ties to a disgruntled former employee. Microsoft says it plans to bring a criminal case for failing to follow proper disclosure coordination and has disabled Nightmare Eclipse's GitHub, GitLab, and MSRC accounts. Kevin Beaumont notes the irony given Microsoft has hired people who have publicly posted zero-day exploits and has purchased exploits from brokers. He argues that criminalizing not following disclosure frameworks could complicate future vulnerability reporting and security research, potentially hindering cooperation between researchers and vendors.