Nightmare Eclipse Banned From GitHub And GitLab After Zero-Day Exploits

A security researcher known as Nightmare Eclipse has been banned from GitHub and GitLab after hosting weaponized zero-day exploit code targeting Windows. The de-platforming follows a rapid release cycle in which the researcher disclosed six distinct vulnerabilities over a six-week period starting in April 2026.

Security researcher faces deplatforming after rapid Windows vulnerability disclosures

The researcher, operating under aliases including Chaotic Eclipse and Dead Eclipse, released exploits for BlueHammer, RedSun, UnDefend, YellowKey, Green Plasma, and MiniPlasma. Microsoft patched three of these vulnerabilities out-of-band on May 21 after Huntress confirmed active exploitation in the wild. CISA subsequently added those three to its Known Exploited Vulnerabilities catalog.

Three zero-days remain unpatched as of publication: YellowKey, Green Plasma, and MiniPlasma. Technical details for the unpatched flaws remain undisclosed, keeping affected systems vulnerable until official updates are issued.

Nightmare Eclipse posted a direct threat targeting Microsoft, stating: 'Mark this date, July 14th. I will make sure your bones are shattered that day.' While the statement likely points toward the next scheduled patch cycle, no concrete evidence of new exploits for that timeframe has been verified.

It remains unconfirmed whether new proof-of-concept code or remote execution tools will surface on July 14. Upcoming release schedules remain unconfirmed and have not yet been validated by external cybersecurity experts.