BigDiskBuster PoC Stops Windows Defender Updates

Overview

• Over the weekend, researcher Abdelhamid Naceri posted BigDiskBuster, a proof‑of‑concept that runs in the background and blocks Microsoft Defender from finishing platform and definition updates.
• Naceri revealed his identity after months of releasing zero‑day PoCs and said BigDiskBuster works on supported Windows versions even though he called the code buggy.
• Microsoft was not immediately available to comment about BigDiskBuster, and security reporting notes that some earlier PoCs from Naceri have been patched while other disclosed issues remain unpatched.
• By stopping updates, the exploit can leave endpoint defenses running out‑of‑date signatures and platform code, which raises the risk that attackers could adapt the PoC into real attacks or bypass fixes.
• Naceri links his disclosures to a dispute over his past Microsoft employment, and his public releases have intensified debate over responsible vulnerability disclosure and the practical risks to users and IT teams.