Microsoft Backpedals on Legal Stance Against Researcher Nightmare Eclipse

Microsoft is changing its vulnerability disclosure policy after a dispute with a security researcher. The company now calls it Coordinated Vulnerability Disclosure instead of responsible disclosure.

Microsoft reverts to Coordinated Vulnerability Disclosure

The shift follows a conflict with researcher Nightmare Eclipse, who publicly criticized Microsoft's handling of reported bugs. Microsoft initially took a legal stance against the researcher but has now backpedaled.

Nightmare Eclipse continues to receive unpatched bugs from other researchers. An upcoming June exploit payload targets Secure Boot and BitLocker encryption.

The policy change marks a return to industry-standard terminology. Microsoft's earlier approach had drawn criticism from the security community.

The Record reported on the policy retreat. The story highlights ongoing tensions between software vendors and security researchers.