Microsoft has patched a zero-day vulnerability disclosed by security researcher Nightmare Eclipse, following what appears to have been a contentious back-and-forth between the two.
Nightmare Eclipse brought the flaw to Microsoft's attention, but the relationship soured into what's been described as a heated rivalry. Microsoft has now issued a fix. A second, separate zero-day also credited to Nightmare Eclipse appears to have been quietly patched as well, with less public acknowledgment.
The episode highlights a friction point that keeps resurfacing in security: researchers and vendors rarely agree on timelines, and when they don't, public pressure tends to substitute for goodwill. Independent researchers have few tools to compel action. Disclosure — coordinated or otherwise — is usually their best one.
That both patches arrived after an open dispute suggests the pressure worked. Whether the process should have required that much of it is a different question.