BitLocker remains a sound baseline for protecting a lost or stolen Windows PC, but the May 2026 “YellowKey” bypass showed why TPM-only disk encryption should not be treated as the final word in physical security.
As PCWorld notes, BitLocker’s encryption still prevents the routine attack it was designed for: removing a drive from a powered-off PC and reading it elsewhere. The concern was a flaw in the Windows Recovery Environment, or WinRE, that let an attacker with hands-on access bypass that protection under affected configurations.
Microsoft tracked YellowKey as CVE-2026-45585 and initially issued a mitigation while it prepared a full update. The important date for administrators is June 9, 2026: Microsoft included a fix in its June Patch Tuesday security releases. That means the story is no longer simply “BitLocker has an unpatched bypass,” but it is a reminder that encryption policy must account for attacks against the boot and recovery path—not just the cryptography itself.
BitLocker commonly uses the TPM to unlock the disk automatically when the system’s expected boot measurements are intact. It is convenient: users press the power button and arrive at the Windows sign-in screen without entering another secret.
That convenience is also the exposure YellowKey highlighted. A machine that can automatically retrieve its disk-unlocking material before Windows sign-in has a wider physical attack surface than one that requires a pre-boot secret.
For laptops carrying especially sensitive material, the more conservative configuration is TPM + PIN, which requires a user-entered PIN before Windows can unlock the volume. It adds friction at startup, but it changes the security model: possession of the PC alone is no longer enough to trigger an automatic unlock attempt.
A practical priority order is:
The YellowKey episode did not make BitLocker useless. It reinforced the more useful conclusion: disk encryption is a layer, and TPM-only BitLocker is optimized for usability—not for every physical-access threat.
As PCWorld notes, BitLocker’s encryption still prevents the routine attack it was designed for: removing a drive from a powered-off PC and reading it elsewhere. The concern was a flaw in the Windows Recovery Environment, or WinRE, that let an attacker with hands-on access bypass that protection under affected configurations.
Microsoft tracked YellowKey as CVE-2026-45585 and initially issued a mitigation while it prepared a full update. The important date for administrators is June 9, 2026: Microsoft included a fix in its June Patch Tuesday security releases. That means the story is no longer simply “BitLocker has an unpatched bypass,” but it is a reminder that encryption policy must account for attacks against the boot and recovery path—not just the cryptography itself.
TPM-only unlock is the trade-off to revisit
BitLocker commonly uses the TPM to unlock the disk automatically when the system’s expected boot measurements are intact. It is convenient: users press the power button and arrive at the Windows sign-in screen without entering another secret.That convenience is also the exposure YellowKey highlighted. A machine that can automatically retrieve its disk-unlocking material before Windows sign-in has a wider physical attack surface than one that requires a pre-boot secret.
For laptops carrying especially sensitive material, the more conservative configuration is TPM + PIN, which requires a user-entered PIN before Windows can unlock the volume. It adds friction at startup, but it changes the security model: possession of the PC alone is no longer enough to trigger an automatic unlock attempt.
Patching matters, but so does the threat model
Windows users should install current cumulative updates, confirm that the June 2026 security updates or later are deployed, and ensure that recovery environments are maintained alongside the operating system. Organizations should also test their BitLocker recovery process rather than assuming recovery keys are retrievable during an incident.A practical priority order is:
- Keep Windows and WinRE security updates current on every managed endpoint.
- Use TPM + PIN for executives, administrators, developers, journalists, and other users whose laptops may attract targeted physical access.
- Require shutdown or hibernation before travel or storage when the device will leave the user’s control.
- Verify that BitLocker recovery keys are escrowed in the intended Microsoft account, Entra ID tenant, Active Directory, or other approved management system.
The YellowKey episode did not make BitLocker useless. It reinforced the more useful conclusion: disk encryption is a layer, and TPM-only BitLocker is optimized for usability—not for every physical-access threat.
References
- Primary source: PCWorld
Published: 2026-07-29T13:00:00+00:00
Windows BitLocker is fine. I still don't trust it with everything | PCWorld
BitLocker may have vulnerabilities, but I’m still recommending it (and its Device Encryption derivative) to users.www.pcworld.com
- Related coverage: notebookcheck.net
YellowKey fully bypasses Microsoft BitLocker encryption on affected Windows PCs: Bitcoins, personal data at risk - Notebookcheck News
Nightmare-Eclipse has released YellowKey, a fully BitLocker encrypted disk bypass for vulnerable Windows 11 and Server systems. The hack leverages code left behind in the WinRE recovery environment to unlock encrypted disks without knowledge of the encryption keys. <b>Updated: Official MS...
www.notebookcheck.net
- Related coverage: windowscentral.com
Microsoft issues mitigation for critical Windows 11 BitLocker flaw exploited with a USB key — "Can't come up with an explanation beside the fact that this was intentional." | Windows Central
Microsoft shares mitigation measures for a critical Windows 11 BitLocker flaw that lets hackers bypass encryption with a simple USB key.www.windowscentral.com - Related coverage: eclypsium.com
YellowKey: The Unpatched BitLocker Bypass Hidden in Windows Recovery - Eclypsium | Supply Chain Security for the Modern Enterprise
An independent researcher disclosed YellowKey, an unpatched BitLocker bypass in the Windows Recovery Environment affecting Windows 11 and Server 2022/2025. A PIN-defeating variant exists but has not been released.eclypsium.com