BigDiskBuster: Unpatched PoC Blocks Microsoft Defender Platform and Signature Updates

Researcher Abdelhamid Naceri (aka MSNightmare/NightmareEclipse/Chaotic Eclipse) published BigDiskBuster on September 19, 2026 — an unverified, unpatched C++ PoC that exhausts disk space and locks MRT.exe so Defender platform and signature updates fail; no…

Security researcher Abdelhamid Naceri published BigDiskBuster on September 19, 2026 (per The Hacker News), a proof-of-concept written in C++ and hosted on GitHub, where it has drawn over 130 stars and 20 forks (GBHackers). The PoC waits for a Microsoft Defender platform or security-intelligence update to begin, then creates hidden delete-on-close temporary files that claim free disk space and opens MRT.exe with restrictive sharing permissions that block write and delete access; the space is released once the update fails. In the researcher's test, Defender reported 'protection definition update failed' with error 0x80070643, and BleepingComputer notes the PoC must keep running in the background to sustain the block. Defender keeps running, but its detection content can go stale, which reports say could progressively degrade detection of new malware, phishing, and ransomware families and enable defense evasion for malware already added to detections. The researcher claims it works on all supported Windows versions, but this is unverified, the code is described as 'a bit buggy' and in need of rewriting, and it is unclear whether administrator rights are required. There is no CVE, no Microsoft advisory, no patch, no independent confirmation of the claimed behavior, and no indication of real-world abuse — although BleepingComputer, The Register, The Hacker News, and Security Affairs characterize it as a zero-day, while Cyber Security News and GBHackers do not. Reports differ on the researcher's name: BleepingComputer, The Hacker News, and The Register identify him as Abdelhamid Naceri; Cyber Security News calls him MSNightmare (aka Nightmare-Eclipse); SecurityWeek calls him Nightmare Eclipse and notes the release followed his revealing his identity; Security Affairs calls him Chaotic Eclipse and says he identifies himself as Abdelhamid Naceri. The release is the latest in an ongoing public dispute with Microsoft over vulnerability disclosure, following prior tools including ShieldCrash (SYSTEM access), ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, and UnDefend; The Hacker News reports Naceri's earlier Defender tools were exploited in the wild before Microsoft patched them, with UnDefend fixed in May 2026 as CVE-2026-45498 — a patch not shown to cover BigDiskBuster's different method. The same researcher has also published privilege-escalation PoCs HardBreacher (Kaspersky Endpoint Security), PrettyPrague (Avast), and FalconFlank (CrowdStrike…