A zero-day exploit circulating online allows people with physical access to a Windows 11 system to bypass default BitLocker protections and gain complete access to an encrypted drive within seconds.

The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM). BitLocker is a mandatory protection for many organizations, including those that contract with governments.

When one disk volume manipulates another

The core of the YellowKey exploit is a custom-made FsTx folder. Online documentation of this folder is hard to find. As explained later, the directory associated with the file fstx.dll appears to involve what Microsoft calls the transactional NTFS, which allows developers to have “transactional atomicity” for file operations in transactions with a single file, multiple files, or ones that span multiple sources.

The steps for carrying out the bypass are simple:

1. Copy the custom FsTx folder from the Nightmare-Eclipse exploit page to an NTFS- or FAT-formatted USB drive
2. Connect the USB drive to the BitLocker-protected device
3. Boot up the device and immediately press and hold down the [Ctrl] key
4. Enter Windows recovery

There are at least two ways to accomplish the third step. One way is to boot into Windows, hold down the [Shift] key, click on the power icon, and click restart. Another is to power on the device and restart it as soon as Windows starts booting.

In either case, a command (CMD.EXE) prompt appears. The prompt has full access to the entire drive contents, allowing an attacker to copy, modify, or delete them. In a normal Windows Recovery flow, the attacker would need to enter a BitLocker recovery key. Somehow, the YellowKey exploit bypasses this safeguard. Multiple researchers, including Kevin Beaumont and Will Dormann, have confirmed the exploit works as described here.

It’s unclear what in the custom FsTx folder causes the bypass. Dormann said that it appears to be related to Transactional NTFS, which itself uses command-log file system under the hood. Dormann further noted that by looking at the Windows fstx.dll, one will see code that explicitly looks for \System Volume Information\FsTx in the FsTxFindSessions() function.”

Looking for the most recent Mini Crossword answer? Click here for today’s Mini Crossword hints, as well as our daily answers and hints for The New York Times Wordle, Strands, Connections and Connections: Sports Edition puzzles.

Need some help with today’s Mini Crossword? It’s not too tough, but 7-Across and 8-Across go together, and I always find paired clues difficult to solve. Read on for all the answers. And if you could use some hints and guidance for daily solving, check out our Mini Crossword tips.

If you’re looking for today’s Wordle, Connections, Connections: Sports Edition and Strands answers, you can visit CNET’s NYT puzzle hints page.

Read more: Tips and Tricks for Solving The New York Times Mini Crossword

Let’s get to those Mini Crossword clues and answers.

Mini across clues and answers

1A clue: Baseball stat hidden in “super big hit”
Answer: RBI

4A clue: Hi, in Hawaii
Answer: ALOHA

7A clue: With 8-Across, start running or going to the gym
Answer: GETIN

8A clue: See 7-Across
Answer: SHAPE

9A clue: Opposite of NNE
Answer: SSW

Mini down clues and answers

1D clue: Opposite of riches, in a saying
Answer: RAGS

2D clue: “Ew, gross”
Answer: BLEH

3D clue: Tiny bits
Answer: IOTAS

5D clue: Where the hands are placed when “Hey, Macarena!” is sung
Answer: HIPS

6D clue: All over again
Answer: ANEW

from the rudderless-ship dept

We’ve complained a great deal about RFK Jr.’s stint running HHS and its effects on the health of Americans in the short and long term because, well, there’s a lot to complain about. His anti-vaxxer stances have begun infecting national vaccine policy, of course, and his stance of essentially ignoring an ongoing 17 month measles outbreak have generated national headlines. Regarding measles cases, by the way, the official case count in America is at roughly 80% of the total of last year already, which was itself the highest case count in several decades. I’ll take this moment to remind you that it’s May, not even half way through the year.

But there has also been an insane amount of chaos at HHS and its child agencies under Kennedy. And that chaos isn’t slowing down, it seems, with the announcement that FDA chief Marty Makary will be resigning his post. And, because this is the dumbest of timelines in which we live, the reason behind it appears to be Trump’s push to allow for flavored e-cigarettes to entice the nation’s youth.

Makary’s insiders said the former Johns Hopkins University cancer surgeon resigned after Trump forced his hand on authorizing fruit-flavored e-cigarettes. Makary had reportedly been resisting the sign-offs out of concern that the kid-friendly flavors could again entice youth use and addiction—something public health officials and experts have for years worked to combat. But Makary’s stance was in conflict with Trump’s “save vaping” campaign promise—and with the tobacco industry’s interests.

Earlier this month, The Wall Street Journal reported that Trump had called Makary over a weekend to scold him for not moving fast enough to authorize flavored vapes, particularly menthol, mango, and blueberry flavors from the Los Angeles manufacturer Glas. The FDA authorized those flavored products days later and issued a new policy that would make it easier to market flavored vapes.

The ArsTechnica post goes on to note that Makary had pissed off a bunch of lobbyists for tobacco, pharma, and biotech firms, all while health professionals have been complaining about his participation in Kennedy’s anti-vaxxer nonsense at the FDA as well. He essentially managed to piss off everyone, courting zero allies, which is a remarkable achievement itself.

But the larger story here is that HHS is suffering from a rather damning lack of leadership. Not by performance, but through vacancies of Senate-confirmed people to actually run things.

The firing or resignation of Food and Drug Administration Commissioner Marty Makary is more intra-MAHA chaos at a beleaguered and battered Department of Health and Human Services. 

When you don’t have a CDC Director, an FDA Commissioner, or a Surgeon General, the obvious question is: Why do you have this HHS Secretary? Robert F. Kennedy, Jr., is the cause of much of the chaos that has resulted in these job vacancies. HHS is rotting from the head. 

It really is incredible to realize that those three positions, important as they are, are currently being helmed by acting leadership members at best. There’s a reason those positions exist. They’re not unimportant. But currently, we have essentially temp employees filling them.

Does anyone really believe that American health is a ship that can be successfully steered without a rudder? That’s what’s happening right now, because Trump and Kennedy can’t seem to get anyone across the finish line in the Senate for these roles. And if the ship crashes, we’re all going to pay for it.

Filed Under: e-cigarettes, fda, flavored vapes, health & human services, hhs, maha, marty makary, rfk jr.

Samsung looks set to take Digital Wellbeing a step further in One UI 9, with a new feature designed to actively reduce app distractions by cutting off internet access for selected apps.

The feature has been spotted in early beta code for the Android 17-based update currently rolling out to the Galaxy S26 series. This suggests it’s still in development, but already quite far along.

The feature, reportedly called “Network management for concentration,” goes beyond the usual app timers found in Samsung’s existing wellbeing tools. Instead of just limiting screen time, it appears to block or restrict internet access for specific apps entirely. This makes them far less useful for time-wasting activities like social media scrolling, video streaming, or gaming.

Leaked screenshots shared by Android Authority show a dedicated “Network restriction” settings page. On this page, users can manually select which apps should lose connectivity, a key difference compared to current Digital Wellbeing tools that typically shut apps down after a set usage limit but still provide access to online content.

Samsung also appears to be adding more control and security around the feature. Code strings suggest users will be able to set a six-digit PIN, preventing others from disabling restrictions without permission. That could make it especially useful for parents managing children’s device usage, where bypassing limits is often too easy today.

Another notable addition is a “Downtime” scheduler, which would allow users to automatically activate restrictions during set hours. That means instead of manually turning the feature on and off, users could have it kick in during work hours, study sessions, or bedtime routines. It would then switch off again automatically afterwards.

In practice, this puts One UI 9 closer to a system-level focus mode rather than a simple timer-based restriction tool. For example, even if a user has downloaded videos offline, blocking internet access would still limit the core functionality of apps like YouTube once restrictions are in place.

That said, the feature is still in its early stages, and there’s no guarantee it will make it into the final release of One UI 9. Samsung will refine several parts of the update before launch. This could include changes or even the removal of this tool.

If it does arrive as described, though, it could become one of Samsung’s most aggressive and useful digital wellbeing features yet.

Brian Barrett: Our best and brightest.

Leah Feiger: Yeah. And so I’m just like, no, no, no, this is clearly not just about tech. This is about showing very specifically who Trump’s allies are and being able to position himself in front of a country and leader that he hasn’t spent a lot of time with recently.

Zoë Schiffer: Since we’re still talking about the people that he is going to China with, what do we know about why Jensen Huang was left off the list and then re-added last minute? Because my though when I saw it was, oh, this is about export controls and they think it’s going to be kind of weird and complicated to have him on the trip. But then obviously he is now on the trip.

Leah Feiger: So someone I cannot name, someone said to me, “Oh, I think the President may have just forgotten him,” to which I laughed.

Zoë Schiffer: Oh, you remembered Brett Ratner and you forgot?

Leah Feiger: No, I was like, “This is not true.” It’s just not even sort of true to the point where I was like, “I’m sorry, you’re expecting me to entertain this right now?”

Zoë Schiffer: I would absolutely buy that Trump forgot this man, but I’m like, “Trump has other people around him.”

Leah Feiger: This team didn’t forget this man.

Zoë Schiffer: Yes, please.

Leah Feiger: No, there’s no way on earth. I was very much just like, “Uh-huh. Yeah, yeah, yeah. Keep it moving.” And obviously guys, we have to talk about the Musk of it all. I know that Elon has been making his appearances back at a variety of White House or White House adjacent events, but this does feel like such a big moment for him to be on the international stage again by Trump’s side.

Zoë Schiffer: Did you know that Elon Musk’s mother is like low-key a celebrity in China?

Brian Barrett: Maye Musk, international model, Maye Musk.

Leah Feiger: Wait, new information. Say more.

Zoë Schiffer: People are obsessed with her there.

Leah Feiger: What?

Zoë Schiffer: Just a little fun fact.

Brian Barrett: I want to take a moment too not to get away from Maye Musk. We can talk and talk about Maye Musk all day long. About a year ago when the Pentagon set up Musk for a war briefing about what would happen if the US went to war. Do we remember this?

Leah Feiger: I do.

Zoë Schiffer: Oh, my gosh, I fully forgot about this. Yes.

Brian Barrett: The Pentagon invited Musk over to check out what the war plans would be if we went to fight China over Taiwan and that got scuttled apparently before he went. This was a New York Times report, but it is how far we’ve come and how not far. I don’t know. If I’m China, I don’t think I want to see Musk anywhere near this coalition. And if I’m Musk, I’m feeling pretty great about the level of influence I now have. Again, and then maybe I get a chance to look at those war plans again. Maybe I can sweet talk Pete Hegseth.

Sony has a camera legacy that most brands, regardless of whether they make cameras or smartphones, dream of. The company rewrote what full-frame sensors could do with its Alpha series. 

That particular rendering of skin tones, that restraint with saturation, the commitment to accurate white balance; the company’s color science is precisely why cinematographers, videographers, and photographers like me, in the consumer tech space, swear by its color science and camera hardware. 

So when the official Sony Xperia X account posted “Origin vs. AI Camera Assistant” side-by-side comparisons, particularly to promote the Xperia Intelligence on the company’s new Xperia 1 VIII, I kept staring at my screen for minutes. Not in admiration, but in genuine disbelief. I’d say this bluntly: whoever approved those samples has either never used a Sony Alpha series camera, or never spoken to someone who does. 

What exactly is Sony’s Xperia Intelligence actually doing to these images?

Let me walk you through this in technical terms, because what’s happening in those pictures deserves a discussion. In the first portrait shot, Sony’s Xperia Intelligence has boosted mid-tone exposure so aggressively that it has clipped the highlights across the grass and the subject’s face. 

The details are blown away, while the dynamic range is all messed up. Similarly, in the shot with the vase, the new AI-based algorithm has crushed the shadows so hard that the floor loses all its texture. While the original picture has some depth and visible wood grain, the edited one looks like it has a flat, high-contrast filter applied, with the intensity slider dragged all the way up. 

Then there’s the sandwich. I genuinely can’t figure out what Sony’s AI saw when it decided those reds and greens needed to be desaturated. Seriously, it looks like someone tuned up the exposure and brightness sliders on the picture, without realizing that they’re blowing up the finer details and the colors. 

Across all three samples, the AI introduces a forced yellow-orange warmth, in different intensities, an artificial white-balance shift that moves every shot away from neutral or natural colors toward what looks like an Instagram or Snapchat filter. They all looked like they were captured from a sensor pushed way past its native ISO ceiling, with plenty of noise. 

I’d say that all the pictures looked better the way they were, but Sony’s AI Camera Assistant or Xperia Intelligence fixed them in a way that’s beyond any post-production repairs. And mind you, the pictures have been posted to promote the exceptional photography results that buyers can achieve with the new Xperia 1 VIII.   

Sony can’t afford an identity crisis

The Xperia 1 series has always been Sony’s answer to the question: what if a smartphone camera behaved like the one on a camera? However, what Xperia Intelligence appears to be doing is chasing the aggressively and unnecessarily processed, high-vibrance aesthetic, that, I’d say, looks worse than what a Samsung, Google, or Apple smartphone would have processed. 

While the originals in the tweet are genuinely well-exposed, have natural-looking colors, and a decent amount of dynamic range, the AI versions look like the Xperia’s camera got bored with being too good. For those who are buying the Xperia 1 VIII for its camera, and that’s almost certainly the reason why they would, get comfortable with the settings menu early; that’s all I have to say. 

Meta’s decision to track employee keystrokes and mouse data is causing an uproar within the company. “Selfishly, I don’t want my screen scraped because it feels like an invasion of my privacy,” wrote an engineer in an internal post seen by nearly 20,000 coworkers this week. “But zooming out, I don’t want to live in a world where humans—employees or otherwise—are exploited for their training data.”

The message aimed to rally support for a petition circulating inside the company since last Thursday that demands an end to what Meta calls the Model Capability Initiative. It’s a piece of mandatory software that Meta began installing on the laptops of US employees last month. The tool records employees’ screens when using certain apps with the goal of collecting “real examples of how people actually use” computers, including “mouse movements, clicking buttons, and navigating dropdown menus,” according to Reuters. Meta has yet to say whether the initial data is paying off.

“I’m mixed on Al. On one hand, I really enjoy using it to write software. On the other hand, I’m really nervous about its impact on the world,” the engineer wrote in an internal forum for coders. “And what kind of norms are we establishing about how the technology is used, and how people are going to be treated?”

The petition, also seen by WIRED, states that “it should not be the norm that companies of any size are permitted to exploit their employees by nonconsensually extracting their data for the purposes of Al training.”

In the US, employers generally have wide latitude to monitor workers’ devices for security, training, evaluation, and safety purposes. But using these tools to build datasets that instruct AI systems on navigating computers without human supervision appears to be a new tactic—and one that doesn’t sit right with many Meta workers. Over the past few years, several companies have jumped into the race to develop agentic AI models. But when gathering data, they have typically tapped volunteers, sometimes paid, who are willing to have their computer activity recorded.

Meta’s decision to move forward with its tracking tool despite weeks of protest from employees has become one of the leading reasons for what 16 current and former employees recently described to WIRED as record-low morale. It’s also the leading driver of an employee unionization effort at Meta’s UK offices.

“The workplace surveillance and training AI models is the number one thing,” says Eleanor Payne, a representative of United Tech and Allied Workers, which is helping organize Meta employees. She declined to specify the number of employees seeking to form a labor union but called it “significant” and unprecedented.

While only US employees are currently subjected to tracking, UK employees are concerned for their colleagues and the potential for expansion of the program. “I think of it pretty much as a breakdown of trust,” Payne says. New laws that eased unionization in the UK have encouraged employees about the chances of success, she adds.

In Meta offices in California and New York, workers have been posting flyers in cafeterias and other communal areas pointing colleagues to the petition. Two employees, speaking on the condition of anonymity because they were not authorized to speak to the media, say the company has removed some posters, with those on bathroom walls seemingly staying up longer.

Observability startup Raindrop AI’s new open source, MIT Licensed “Workshop” tool, launched today, gives developers something that they’ve likely wanted, perhaps subconsciously, since the agentic AI era kicked off in earnest last year: a local debugger and evaluation tool specifically designed for AI agents, allowing devs to see all the traces of what their agent has been doing in a single, lightweight Structured Query Language (SQL) database file (.db)

It functions as a local daemon and UI that streams every token, tool call, and decision to a local dashboard—typically hosted at localhost:5899—the moment it occurs. By visiting their localhost, developers can then see everything their agent was up to — including mistakes or errors — and identify what went wrong, when, and ideally, discern why. It’s all stored in a single .db file, which takes up relatively little memory, according to a X direct message VentureBeat received from Ben Hylak, Raindrop’s co-founder and CTO (and a former Apple and SpaceX engineer).

This real-time telemetry eliminates the latency of traditional polling and addresses a growing developer concern regarding the privacy of sending local traces to external servers.

The tool is available for macOS, Linux, and Windows. It can be installed through a one-line shell command that automates binary placement and PATH configuration for bash, zsh, and fish shells. For developers who prefer to build from source, the repository is hosted on GitHub and utilizes the Bun runtime.

The product: establishing a self-healing eval loop

The platform’s standout feature is the “self-healing eval loop,” which allows coding agents like Claude Code to read traces, write evals against the codebase, and fix broken code autonomously.

In a practical application, if a veterinary assistant agent fails to ask necessary follow-up questions, Workshop captures the full trajectory. Claude Code then reads this trace, writes a specific eval, identifies the logic error in the prompt or code, and re-runs the agent until all assertions pass.

Compatibility and ecosystem integration

Workshop is compatible with a broad range of programming languages, including TypeScript, Python, Rust, and Go.

It integrates with popular SDKs and frameworks such as the Vercel AI SDK, OpenAI, Anthropic, LangChain, LlamaIndex, and CrewAI. It is also designed to work seamlessly with various coding agents, including Claude Code, Cursor, Devin, and OpenCode.

Licensing and community implications

Workshop is released under the MIT License, ensuring it remains free and open-source for all users. This permissive licensing is intended to foster community contribution and allow enterprise users to maintain data sovereignty.

Hylak noted on X that the tool was built to provide a “sane” way to debug agents locally, changing how their team and early customers build autonomous systems.

To celebrate the launch, Raindrop offered limited-edition physical merchandise to users who installed the tool and executed a specific “drip” command.