By The Hacker News
Publication Date: 2026-09-22 16:14:00
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19.
The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in attacks.
When updates are blocked, Defender keeps running, but its detection content grows stale. The researcher’s screenshot shows Defender returning a generic Windows error when trying to update, but whether the failure raises an automatic alert is not clear from the proof-of-concept alone.
Naceri said he was dismissed from Microsoft’s Security Response Center in 2024 and has been releasing exploits without coordinating with the company since April.
His first three Defender tools — BlueHammer, RedSun, and UnDefend — were all