Andrew Morris
Coverage of Andrew Morris in the Nexus archive.
- Nightmare Eclipse incident shows the researcher-vendor fights may never fully go away
Microsoft threatened criminal legal action against security researcher 'Nightmare Eclipse' for publicly disclosing zero-day vulnerabilities without prior coordination. The researcher claimed Microsoft refused to communicate, deleted their security response account, and flagged their GitHub account, escalating a public dispute over vulnerability disclosure practices.
- Network ‘background noise’ may predict the next big edge-device vulnerability
Research by GreyNoise indicates that spikes in network traffic targeting edge devices can predict upcoming vulnerability disclosures, often up to nine days before public alerts. The study found that 50% of detected activity surges led to vendor disclosures within three weeks, highlighting coordinated attacker behavior against security appliances.