Microsoft says it will not pursue researchers for publishing 0-day exploits

▤ Summary

Microsoft says it will not pursue researchers solely for publishing 0-day exploit findings, as long as they follow its coordinated disclosure expectations. The piece discusses the Nightmare Eclipse campaign and several exploit families affecting Microsoft products such as Windows, Visual Studio Code, GitHub, and GitLab. It also references the company’s MSRC and Digital Crimes Unit as part of the response process. The report highlights ongoing security research, vulnerability disclosure, and the tension between exploit publication and responsible reporting.

▦ Linked Companies