# Security researcher finds zero-day in CrowdStrike Falcon Microsoft-focused researcher now targets other security products - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-09-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/9539ee8f-8fe0-4fa7-b5f0-e7e41ae7011f ## Researcher's new target Security researcher known as Nightmare Eclipse, previously focused on Microsoft vulnerabilities, has discovered a new zero-day called 'FalconFlank' in CrowdStrike's Falcon endpoint security platform. The exploit abuses the platform's Microsoft Office macro remediation feature to enable privilege escalation. CrowdStrike advised customers to temporarily disable the suspicious macro removal feature while investigating. ## Technical details of the flaw The FalconFlank vulnerability works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with 'Phase 3 - Optimal Protection' and malicious macro removal enabled. The researcher published proof-of-concept exploit code on GitHub but warned that CrowdStrike likely already has detection mechanisms in place, requiring testers to obfuscate the PoC. ## Industry reactions Security expert Kevin Beaumont confirmed the exploit works and said Nightmare's recent discoveries highlight quality issues across endpoint security products. Beaumont hopes these findings will push cybersecurity vendors to focus on actual product security rather than hypothetical AI threats, forcing the industry to improve its game. ## Other security product vulnerabilities Nightmare recently found 'HardBreacher', a privilege escalation bug in Kaspersky's endpoint antivirus, and 'PrettyPrague' in Gen Digital's Avast software - both working on fully patched systems. While Avast's parent company is developing a patch, Kaspersky hasn't yet commented. These discoveries show the researcher's expanding focus beyond Microsoft products. ## Nvidia vulnerability found The researcher also disclosed 'GreenSection', a memory corruption vulnerability in Nvidia products, though this one merely crashes systems and isn't considered as critical. Nvidia hasn't responded to inquiries. These developments demonstrate how security researchers are now targeting the entire industry rather than single vendors. ## Broader industry problem As Beaumont noted, endpoint security products' own security has become questionable. There's growing emphasis on strengthening fundamental security features rather than focusing on AI marketing hype. Nightmare's findings reveal these products aren't providing the protection they promise, raising concerns about their effectiveness. ## Company responses CrowdStrike directed customers to its support portal for the FalconFlank Tech Alert, maintaining cloud anti-malware protection remains effective. Gen Digital announced it's developing a patch for the Avast vulnerability. However, Kaspersky and Nvidia's silence raises transparency concerns, potentially damaging customer trust in their security products. ## Warning for the industry These incidents highlight the cybersecurity industry's need to secure its own products. The vulnerabilities discovered by researchers expose weaknesses across major security providers, not just Microsoft. To maintain customer confidence, companies must prioritize fundamental security measures over marketing claims about advanced capabilities. ## Sources covering this story - https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._