Microsoft under fire for threatening security researcher with criminal investigation

A researcher known as Nightmare Eclipse posted unpatched Microsoft vulnerabilities and exploit code on public repositories.

Microsoft said the disclosure could help attackers and warned of possible civil or criminal action.

Nightmare Eclipse says Microsoft mishandled their reports, while critics argue the company’s response may chill future disclosures.

The dispute has renewed debate over responsible disclosure, bug bounties, and how vendors should handle security researchers.