“It’s nasty, but it requires physical access to the computer,” the blog post reported after a researcher published a zero‑day that affects standard Windows 11 encryption setups.
YellowKey and the researcher using the alias Nightmare‑Eclipse
The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare‑Eclipse. The publication includes a public presence: the researcher’s GitHub account is part of the disclosure and the release has generated discussion in an online forum thread referenced by the post.
What YellowKey does to BitLocker on Windows 11
According to the published material, YellowKey reliably bypasses default Windows 11 deployments of BitLocker. BitLocker is described in the post as the full‑volume encryption protection Microsoft provides to make disk contents off‑limits to anyone without the decryption key. That decryption key is stored in a secured piece of hardware known as a trusted platform module (TPM).
Physical access is a defining constraint
The post emphasizes a single operational constraint that shapes the exploit’s risk profile: it requires physical access to the target machine. That limitation does not, however, nullify the technical significance of the bypass; the published claim is that YellowKey defeats BitLocker protections as configured by default on Windows 11 machines when an attacker can be physically present at the device.
How organizations that contract with governments, Windows 11 administrators, and the research community are positioned
- Organizations that contract with governments: BitLocker is mandatory protection for many organizations, including those that contract with governments. The publication that YellowKey bypasses default Windows 11 BitLocker deployments therefore touches systems subject to those mandatory protections and raises questions about relying on default configurations when physical access to devices is possible.
- Windows 11 system administrators and security teams: Teams responsible for default Windows 11 deployments are directly implicated by the claim that YellowKey “reliably bypasses” BitLocker in default configurations. The disclosure and the researcher’s public postings — including a GitHub account and conversation threads — provide concrete artifacts for review.
- The researcher and the research community: Nightmare‑Eclipse’s public publication and the ensuing online discussion (including a referenced forum thread) are the immediate vectors through which YellowKey and related technical details have entered public view.
Where the disclosure appeared and how to follow it
The blog post points readers to a Slashdot thread that has discussed the disclosure and to Nightmare‑Eclipse’s GitHub account as the primary public artifacts tied to the publication. Those links are the locations cited for the exploit details and community reaction.
YellowKey, as presented in the published material, is a clear example of a focused technical bypass: it targets default Windows 11 BitLocker deployments, it is said to do so reliably, and it requires physical access to the machine. The public postings — the researcher’s GitHub presence and the forum discussion — are where the technical particulars and community responses are being documented and debated.
Original story: https://www.schneier.com/blog/archives/2026/05/zero-day-exploit-against-windows-bitlocker.html
