The researcher known as Nightmare Eclipse, also going by Chaotic Eclipse, published proof-of-concept code for LegacyHive on GitHub hours after Microsoft's July 15 Patch Tuesday release. The vulnerability is in the Windows User Profile Service, also called ProfSvc, which creates, loads, and manages user profiles during sign-in. Windows loads a portion of a new user's profile before that user signs in for the first time. LegacyHive abuses the path the User Profile Service uses when loading a registry hive during that process, allowing a standard user to redirect the operation toward another account's UsrClass.dat file. This lets an attacker mount and read another user's classes registry hive, including an administrator's. If the hive can be modified, the attacker can configure the registry to run malicious code when the administrator signs in or performs a routine action, causing that code to execute inside the administrator's session. The public proof-of-concept was deliberately stripped before release. As published, it requires a standard user account, an additional set of credentials, and a third username belonging to an administrator target. Nightmare Eclipse stated that the original exploit does not require extra credentials and is not limited to the UsrClass.dat hive. Independent researchers including Kevin Beaumont confirmed the stripped proof-of-concept works on systems running the July 2026 patches. Microsoft told SecurityWeek it is aware of the reported vulnerability and actively investigating. No CVE has been assigned. No patch is available. The release follows a documented pattern: Nightmare Eclipse has released nine Windows zero-days since April 2026 as part of a public dispute with Microsoft over its bug bounty program and account suspension.

Palo Alto Networks Unit 42 published research on TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework. Researchers recovered the full source code, compiled binaries across 17 CPU architectures, Docker-based test infrastructure, and 254 automated DDoS benchmark reports from internal telemetry. The botnet uses a C-based agent that cross-compiles for ARM, MIPS, x86_64, PowerPC, RISC-V, and twelve other architectures, a Go-based command-and-control server with a DDoS-for-hire administrative panel, and a Telnet brute-force module loaded with 1,496 credential pairs covering common default and vendor-specific logins. Additional access paths include SSH scanning, HTTP probing, and Android Debug Bridge scanning against poorly secured routers, cameras, DVRs, and embedded systems. Its lineage traces to Mirai, AISURU, and the open-source MHDDoS DDoS toolkit. The source code contains clear evidence of LLM assistance: the AI safety disclaimer was left verbatim in the shipped binary, and the LLM's chain-of-thought reasoning appears as comments throughout the codebase. One comment reads "// I created them so I should know?" and another "// Wait, where is the command?" These artifacts also point to specific implementation bugs including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake Argon2id routine that actually performs repeated SHA-256 hashing. Unit 42 assessed the botnet as roughly 70% functional as recovered, with core infection, brute-forcing, persistence, primary C2 communications, and UDP, TCP, and DNS flooding all working correctly. The C2 server at 209.182.237[.]133 was confirmed active, and six new compiled samples appeared in Unit 42 telemetry in April 2026, indicating the operator continued development after the recovered artifacts were created. Unit 42 noted that its own researchers fixed the identified defects using a handful of targeted LLM prompts, and that the operator, who holds the complete source code, could do the same.