Reported by 2 outlets

Timeline

1. original reporting

   Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits

   securityweek.com · 36d ago · September 7th, 2026

   The security researcher known as Nightmare Eclipse has dropped three zero-day exploits targeting products from Avast, CrowdStrike, and Nvidia. Also known as Chaotic Eclipse, Infinite Nightmare, and MSNightmare, the security researcher came to fame for a series of zero-day exploits targeting Microsoft’s products, but has recently moved to other vendors as well. In late August, Nightmare Eclipse released a privilege escalation zero-day in a Kaspersky endpoint security product. Dubbed HardBreacher , the exploit has been patched by Kaspersky on August 31. Within a short window last week, Nightmare Eclipse dropped three new zero-day exploits, dubbed PrettyPrague, FalconFlank, and GreenSection. The PrettyPrague proof-of-concept (PoC) code, the researcher says, targets the Avast sandbox to spawn a shell with full system privileges, and may also affect other GenDigital products, including AVG and Norton. “Gen was recently made aware of a security vulnerability affecting a subset of Gen products, including Avast Antivirus, that could allow an attacker to elevate their system privileges. We immediately initiated our security response procedures and have fixed the issue. We take all security matters seriously and encourage users to keep their products up to date to ensure they are protected,” a GenDigital spokesperson said, responding to a SecurityWeek inquiry. FalconFlank exploits a bug in the Office malicious macros remediation feature of Cro

2. update from malware.news

   Nightmare-Eclipse Zero-Days Hit CrowdStrike, NVIDIA, Avast & More

   malware.news · 35d ago · September 8th, 2026

   Key Findings Nightmare-Eclipse has shifted targets. Every prior release from this persona, from BlueHammer in April 2026 through ShieldBreak in August 2026, targeted Microsoft Defender, BitLocker, or another native Windows component. This batch targets the third-party security and driver software organizations layer on top of Windows: CrowdStrike Falcon, NVIDIA GPU drivers, Gen Digital Avast Antivirus, and Kaspersky Endpoint Security. Four zero-day proof-of-concept exploits were published between August 29 and September 3, 2026. None were coordinated with the affected vendors. No CVEs have been assigned. FalconFlank escalates a standard user to NT AUTHORITY\SYSTEM against CrowdStrike Falcon Sensor. It abuses a TOCTOU race via Transactional NTFS to atomically replace a legitimate file with a malicious payload, which a built-in Windows scheduled task then loads as SYSTEM. Exposure requires the Microsoft Office file malicious macro removal capability to be enabled. GreenSection corrupts memory in NVIDIA's GPU display driver stack. A globally shared named memory section is created with SECTION_ALL_ACCESS granted to the Everyone SID, so any unprivileged user can overwrite GPU telemetry structures consumed b