Researcher leaks two Windows zero-days

This "vigilante disclosure" campaign creates a massive headache for IT admins, as the BitLocker bypass (YellowKey) effectively functions as a physical-access backdoor.

• –YellowKey exploits an undocumented WinRE component to bypass encryption even in TPM+PIN configurations
• –GreenPlasma targets the ctfmon.exe subsystem for local privilege escalation to SYSTEM
• –The researcher's "Patch Tuesday leaks" threat forces Microsoft into a reactive, high-stakes patching cycle
• –Confirmation of real-world weaponization by threat actors underscores the immediate risk of these public PoCs
• –This incident highlights the breakdown in trust between individual researchers and corporate bug bounty programs