In late May 2026, threat actors began actively exploiting multiple zero-day vulnerabilities in Microsoft Windows and Microsoft Defender, including at least three Defender-specific flaws and a Windows zero-day linked to a campaign Cyderes identifies as ‘BlueHammer’ (pending corroboration from additional sources), before patches were available. The simultaneous report that Microsoft issued legal threats against researchers who discovered or disclosed these vulnerabilities has fractured cooperation between the vendor and the broader security community, potentially slowing future coordinated disclosure. For security leaders, this event signals a deteriorating vulnerability disclosure ecosystem at precisely the moment when unpatched Microsoft infrastructure faces active, in-the-wild attacks. Note: Claims in this item are based on T3 reporting (vendor blogs, social media, community outlets) and pending confirmation from official MSRC advisories or CISA alerts.