The Register reported on 3 September 2026 (19:08 UTC; 4 September Perth time) that the researcher known as Nightmare Eclipse dropped FalconFlank, a zero-day affecting CrowdStrike's Falcon endpoint security platform.

According to the researcher, FalconFlank is a privilege escalation that abuses the Microsoft Office malicious macros remediation feature in CrowdStrike Falcon.

The Register says the proof of concept works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Phase 3 - Optimal Protection and the malicious macro removal feature enabled, as the researcher said in a GitHub README, and that security researcher Kevin Beaumont confirmed the exploit works. The researcher wrote, as quoted by The Register, that CrowdStrike would already have detections for it, so testing needs an exclusion or an obfuscated proof of concept with a changed DLL load technique.

A CrowdStrike spokesperson said, as quoted by The Register: "We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting," and "Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal." (source: The Register)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: FalconFlank README on Project NightCrawler)

Correction (03 Nov 2026): the card now rests on The Register's report, which carries CrowdStrike's statement, and the FalconFlank README is linked only as the researcher's account; the card date moved from 3 to 4 September 2026 (Perth time), from The Register's visible publication time of 19:08 UTC on 3 September. (source: The Register)