GoKawiilResearcher Naceri releases 'BigDiskBuster' zero-day blocking Windows Defender updates
Security researcher Abdelhamid Naceri published a new proof-of-concept exploit called BigDiskBuster that, when run in the background, prevents Microsoft Defender from installing platform or signature updates on any supported Windows version. Naceri describes it as similar to his earlier UnDefend exploit, and says the code is still buggy but demonstrates the concept clearly. This is the latest in a string of nearly a dozen Defender and Windows-related exploits he has released since April 2026 amid an ongoing dispute with Microsoft over his termination.
A tool that silently freezes antivirus definitions leaves systems exposed to known malware without users realizing protection has stalled, making it a serious risk if weaponized. The repeated disclosures also highlight tension between Microsoft and a disgruntled former contributor, raising questions about how the company handles insider grievances that spill into public security research.
- BigDiskBuster blocks Windows Defender from receiving signature or platform updates while running.
- It's part of a long series of zero-days Naceri has released since a dispute over his 2025 termination.
- Microsoft has warned of possible legal action over what it calls malicious activity from these disclosures.
Yubico YubiKey 5C NFC — With Windows Defender zero-days circulating and antivirus updates potentially being blocked, hardening your login security with hardware-based authentication is a smart complementary defense. A YubiKey adds a physical layer of protection that doesn't rely solely on antivirus signature updates, making account takeover much harder even if malware slips past software defenses.
See Yubico YubiKey 5C NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-22
Published there as: “New Windows Defender zero-day blocks Microsoft antivirus updates”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.