EDR as attack surface

FalconFlank PoC turns CrowdStrike's macro cleanup into a local privilege escalation

Chaotic Eclipse published working code that abuses Falcon's Office macro removal on fully patched Windows 11 25H2 and Server 2025. It is the fourth endpoint product the researcher has dropped exploit code for, and no CrowdStrike response is on record.