Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
2026-06-12T08:51:45Z•a46745c9b0c634ab6874f7077101178e35fdf344f294700aced10365da2202b7
BadHostBitLocker-bypassCISA-credentialsDashlaneLinux kernelMeta AIMicrosoftStarletteTeamPCPbackdoorbotnetcredential-stealercritical-vulnerabilityexploit-codelocal-privilege-escalationnpmopen-source-securitypassword-managersandbox-escapesupply-chainuse-after-freezero-day
What happened
Ars Technica roundup (May–Jun 2026) detailing multiple high- and critical-severity incidents: Microsoft patched at least one researcher-disclosed 0-day (and a separate disclosure by 'Nightmare Eclipse'); a one-character use-after-free in the Linux kernel that can enable sandbox evasion and local root; a critical 'BadHost' vulnerability in the Starlette package impacting millions of AI agents; a reported zero-day that defeats default Windows 11 BitLocker protections; and widespread supply-chain attacks (Red Hat packages backdoored via its npm channel, TeamPCP poisoning open source, dozens of MS
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- arstechnica_security
- Record identifier
- a46745c9b0c634ab6874f7077101178e35fdf344f294700aced10365da2202b7
- Enrichment time
- 2026-06-12T08:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.