SANS Stormcast Thursday, May 14th, 2026: Flexbile Windows Proxy; News from Nightmare Eclipse; Adobe Patches

Summary

SANS Stormcast – May 14, 2026: Flexible Windows Proxy, Nightmare Eclipse Vulnerabilities, Adobe Patches

Episode Overview

In this episode, Johannes B. Ullrich provides a concise summary of the latest cybersecurity news and research updates. He highlights a practical tool for Windows proxy traffic redirection, breaks down two newly disclosed vulnerabilities by the researcher “Nightmare Eclipse,” and gives a rundown of critical Adobe patches released on Patch Tuesday.

---

Key Discussion Points & Insights

1. Tool Highlight: Proxifier for Windows Application Traffic

• [00:19] Johannes shares a listener tip from Rob involving the use of Proxifier.
  • Proxifier allows Windows users to “proxy the HTTP traffic from specific binaries.”
  • Traditional network rules can proxy all traffic, but Proxifier lets you isolate and redirect traffic for a single application, reducing “noise” and complexity.
  • Rob used Proxifier to redirect a specific application’s traffic to Burp Suite for more targeted API exploration, streamlining testing efforts.
  • Quote:

    “This approach is really kind of neat in order to cut down on the noise... and it can be sometimes challenging to figure out what traffic is actually originating from a specific binary. This makes the entire process so much easier.” – Johannes [01:00]

2. Researcher News: Nightmare Eclipse’s New Vulnerabilities

• Nightmare Eclipse (known for the “Bluehammer” exploit) publicly disclosed two new Windows vulnerabilities after unsuccessful bug bounty submissions to Microsoft:

  a. Yellow Key: BitLocker Attack

  • [01:28]
    • Exploits BitLocker, Microsoft’s disk encryption tool, with a USB stick containing specific files.
    • Prevents BitLocker from locking the disk during shutdown, allowing attackers to reboot in rescue mode and access encrypted data “without being…hindered by any kind of access control.”
    • Johannes notes the seriousness of this flaw and the cleverness of the technique.
    • Quote:

      “The disk is not locked as the system is shut down, and then a user may be able to reboot the system into rescue mode and access the still encrypted disk without being, well, sort of hindered by any kind of access control.” – Johannes [01:45]

  b. Screenplasma: Privilege Escalation

  • [02:35]

    • A general remote privilege escalation issue making sensitive memory accessible to unprivileged users for DLL injection.
    • The proof of concept is partial, but researchers have already expanded on possible exploitation paths.
    • Quote:

      “It essentially just makes memory available to any user that can then be used to inject DLLs and such…any attacker has to do a little bit more work here, but others have already kinda elaborated on how the exploit works...” – Johannes [02:42]

  • Summary:

    • Yellow Key: Full exploit available – disables BitLocker protections.
    • Screenplasma: Partial proof of concept – further exploitation likely.
    • Quote:

      “Yellow key disables BitLocker and we have a full exploit available for it, and green plasma is yet another privilege escalation flaw.” – Johannes [03:13]

3. Adobe Patch Updates

• [03:34] Johannes details critical Adobe product patches released during the most recent Patch Tuesday.
  • Adobe Connect: Fixed a deserialization vulnerability that could let attackers execute arbitrary code.
  • Adobe Commerce:
    • Fixed two critical vulnerabilities:
      • Remote code execution via cross-site scripting.
      • Path traversal (improper pathname restriction), allowing arbitrary file system writes; described as “not that terribly difficult to exploit.”
  • In total, 10 products were patched; urgency is advised.
  • Quote:

    “So definitely get those patches out…We got a total of 10 Adobe products being patched in this Tuesday’s patch Tuesday update from Adobe.” – Johannes [04:18]

---

Notable Quotes & Memorable Moments

• On isolating application traffic with Proxifier:

  • “This makes the entire process so much easier.” – Johannes [01:02]

• On the impact of the Yellow Key vulnerability:

  • “The disk is not locked as the system is shut down... access the still encrypted disk without being... hindered by any kind of access control.” – Johannes [01:49]

• On Adobe Commerce vulnerabilities:

  • “One is an RP code execution vulnerability via cross site scripting, which is sort of interesting. And then we also do have an Arbri file system, right? ... a path traversal vulnerability which tends to be not that terribly difficult to exploit.” – Johannes [03:57]

---

Timestamps for Key Segments

• [00:19] – Proxifier tool use case and benefits
• [01:28] – Nightmare Eclipse’s “Yellow Key” BitLocker vulnerability explained
• [02:35] – “Screenplasma” privilege escalation bug discussion
• [03:34] – Adobe Patch Tuesday roundup: critical fixes for Connect and Commerce

---

Summary

This Stormcast episode efficiently covers:

• A clever Windows proxying tip to streamline security testing.
• Two newly disclosed critical Windows vulnerabilities (targeting BitLocker and privilege escalation), emphasizing rapid public disclosure after bug bounty rejection.
• Urgent Adobe product patches, with specific attention to easily exploitable flaws in commerce products.

Johannes’s tone remains practical and focused, urging listeners to consider immediate risk mitigation steps, leverage focused testing tools, and apply vendor patches promptly.

Transcript

[A]

Hello and welcome to the Thursday, May 14, 2026 edition of the sans Internet stormsrunners stormcast. My name is Johannes Ulrich, recording today from San Diego, California and this episode is brought to you by the Sans Edu Graduate Certificate Program in Cybersecurity Engineering in Diaries. Today we do have an interesting tool recommendation from Rob. Rob, experiment with a tool called Proxifier. Now, what Proxifier is good at is if you have a Windows system and you're trying to proxy the HTTP traffic from specific binaries. Now with network rules and such, you're often able to direct traffic to particular destinations to a proxy. But what this tool allows you is to essentially isolate the traffic from a specific application that you're trying to test. And in the case of Rob, well, he directed a traffic to Burp suite in order to better explore an API that a particular application was using. This approach is really kind of neat in order to cut down on the noise that you often get if you are just sending all traffic to a proxy. And it can be sometimes challenging to figure out what traffic is actually originating from a specific binary. This makes the entire process so much easier. And then you have two new vulnerabilities being disclosed by Nightmare Eclipse, the researcher who made a name for themselves by releasing for example Bluehammer after their bug report was rejected by Microsoft's bug bounty program. The first vulnerability being released, and I think that's the more serious one, is called, called Yellow Key. This particular vulnerability attacks BitLocker in a rather effective way. So BitLocker of course, well respected disk encryption by Microsoft, but it relies on bitlocker actually locking the disk as the system is being shut down. And that's the part where Yellow key comes into place by attaching a USB stick to a Windows system. And that USB stick must contain very specific files. The disk is not locked as the system is shut down. And then a user may be able to reboot the system into rescue mode and access the still encrypted disk without being, well, sort of hindered by any kind of access control. Interesting vulnerability and also interesting find here. Apparently this was identified by reverse engineering some of the Windows binaries. The second vulnerability that was disclosed by Nightmare Eclipse is screenplasma. And that's sort of a more universal remote privilege escalation vulnerability. It essentially just makes memory available to any user that can then be used to inject DLLs and such. This particular vulnerability is not fully implemented in the proof of concept being released. So any attacker has to do a little bit more work here, but others have already kind of elaborated on how the exploit works and how it could work given the partial proof of concept. So yellow key disabled spitlocker and we have a full exploit available for it and green plasma is, well, yet another privilege escalation flaw. And we only have a partial proof of concept at least released by Nightmare Eclipse at this point. And then I'm going to talk a little bit about Adobe vulnerabilities that were patched yesterday. I didn't mention them for the patched Tuesday update because, well, we had all of these software supply chain vulnerabilities to talk about first. Adobe Connect did receive an update that fixed a deserialization vulnerability that can execute arbitrary code. So that one is certainly one to pay attention to. And then, well, one of my favorite Adobe products when it comes to vulnerabilities, Adobe Commerce, we have two critical vulnerabilities here that deserve some attention. One is an RP code execution vulnerability via cross site scripting, which is sort of interesting. And then we also do have an Arbri file system, right? It says here improper limitation of pathname or restricted directory. Well, a path traversal vulnerability which tends to be not that terribly difficult to exploit. So definitely get those patches out. We got a total of 10 Adobe products being patched in this Tuesday's patch Tuesday update from Adobe. Well, and that's all we have time for today, so thanks for listening, thanks for liking, thanks for subscribing to the podcast. Remember, there's also a video version on YouTube if you prefer that format. That's it for today and talk to you again tomorrow. Bye.