NEWS

YellowKey Bypass Hits BitLocker With No Patch and a Public Exploit

Published

3 days ago

May 20, 2026

On May 12, a security researcher known online as Nightmare-Eclipse released working exploit code for a Windows BitLocker bypass that needed nothing more than a prepared USB stick and physical access to the target machine. Microsoft assigned the flaw its formal identifier, CVE-2026-45585, on May 20 and immediately rated exploitation as “More Likely” given that proof-of-concept code is already circulating publicly. No patch is available, and Microsoft has not published a timeline for one.

What the company released instead is a mitigation that requires administrators to mount the Windows Recovery Environment (WinRE) image on each affected device, load a registry hive from inside that image, and manually remove a single executable entry from the system boot sequence. On a managed enterprise fleet with centralized tooling, that is a significant coordination exercise. On consumer hardware and unmanaged endpoints, it will largely not happen.

How YellowKey Opens a Locked Drive

The bypass uses a Windows file system feature called Transactional NTFS (TxF, a journaling mechanism introduced in Windows Vista in 2007 to make file operations recoverable after mid-process failures). Microsoft formally deprecated TxF years ago but never removed it from the operating system. Inside WinRE, a binary called autofstx.exe automatically processes TxF log files from a directory named FsTx on attached storage, including log files staged on USB drives, as documented in Microsoft’s Transactional NTFS technical reference.

The attack chain follows five steps:

Specially crafted FsTx log files are copied into a \System Volume Information\FsTx directory on a USB drive.
The USB drive is inserted into the target machine.
The system reboots into WinRE, the recovery environment present on virtually every Windows installation by default.
autofstx.exe processes the FsTx logs from the USB drive. Those logs delete winpeshl.ini, the configuration file that tells WinRE which application to launch at startup.
With winpeshl.ini removed, WinRE falls back to a plain command prompt. Holding CTRL at the right moment during boot triggers the shell. The Trusted Platform Module (TPM) chip has already released the BitLocker volume key as part of the normal trusted boot sequence, leaving the attacker with unrestricted, credential-free access to a fully decrypted drive.

No credentials are required at any point. No software installation, no network connection. The exploit works because the TPM releases its key before WinRE spawns the shell, meaning the attacker inherits a filesystem the hardware has already transparently decrypted.

Vulnerability analyst Will Dormann, of Tharros Labs, independently reproduced the attack using a USB drive and confirmed the mechanism. In his analysis, he flagged a secondary concern: TxF log files on one volume being able to modify files on a completely separate volume during WinRE startup is, in his view, a distinct vulnerability beyond the BitLocker bypass it enables. Microsoft has not commented specifically on that cross-volume behavior in its advisory language.

YellowKey BitLocker bypass CVE-2026-45585 leaves Windows 11 drives exposed without a patch.

A Researcher Running Out of Patience

The YellowKey exploit went public on May 12, one day after Microsoft’s May Patch Tuesday cycle, timing that appears deliberate. The researcher operates under the handle Nightmare-Eclipse on GitHub and, separately, as Chaotic Eclipse. They described the flaw as “one of the most insane discoveries I ever found” and characterized it as functioning like a backdoor, noting that the vulnerable autofstx.exe component exists only inside the WinRE image and not in the standard Windows installation. Microsoft has not confirmed that characterization and says the behavior is unintentional.

YellowKey sits at the end of a longer sequence of public zero-day disclosures targeting Microsoft products from the same researcher:

BlueHammer (CVE-2026-33825) – a Windows local privilege escalation vulnerability, patched by Microsoft in April
RedSun – a second privilege escalation flaw, silently addressed by Microsoft with no public advisory issued
UnDefend – a vulnerability allowing attackers to block Microsoft Defender from receiving signature updates or to disable it entirely
GreenPlasma – a Windows CTFMON service privilege escalation exploit, released alongside YellowKey on May 12

Microsoft’s advisory described the situation plainly, stating the proof of concept was made public “violating coordinated vulnerability best practices.” The researcher has since told Microsoft in public posts that disclosures would continue “as long as you want, unless you extinguish it,” and promised a “big surprise” timed to the June Patch Tuesday release. No further detail on that promise has been published.

One detail significantly complicates the response. Nightmare-Eclipse has stated that a second proof of concept capable of bypassing TPM+PIN protection already exists and is being deliberately withheld. TPM+PIN is precisely the stronger of Microsoft’s two recommended mitigations for CVE-2026-45585.

Affected Windows Versions

Microsoft’s formal advisory covers five configurations. Windows 10 is absent because its WinRE setup differs in ways that prevent the same attack path from completing.

System	Architecture	Formally Affected	Notes
Windows 11 24H2	x64	Yes	Listed in Microsoft’s official advisory
Windows 11 25H2	x64	Yes	Listed in Microsoft’s official advisory
Windows 11 26H1	x64	Yes	Listed in Microsoft’s official advisory
Windows Server 2025	x64	Yes	Includes Server Core installation variant
Windows Server 2022	x64	Not formally listed	Flagged by independent researchers as potentially vulnerable via the same WinRE path; Microsoft has not addressed it in the advisory
Windows 10 (all versions)	x64	No	WinRE configuration prevents this attack path from running

The CVSS (Common Vulnerability Scoring System) score of 6.8 places the flaw in the medium-severity band numerically, driven by the physical-access requirement. Microsoft’s own exploitation probability rating, “More Likely,” signals a different calculus, one shaped by the fact that working exploit code is publicly available and does not require specialized skills to use. Independent researchers have also flagged Windows Server 2022 as potentially vulnerable via the same WinRE recovery path, though Microsoft has not addressed that in its current advisory.

What Microsoft’s Mitigation Requires

The Registry Fix

The first mitigation targets autofstx.exe directly, removing it from the WinRE boot sequence so it cannot process FsTx logs during recovery. Per Microsoft’s official CVE-2026-45585 mitigation guidance, administrators must mount the WinRE image on each device, load the system registry hive from inside the mounted image, then locate the Session Manager’s BootExecute value and remove the autofstx.exe entry from its REG_MULTI_SZ data. Microsoft updated the advisory on May 21 to include an automation script that can execute these steps, which simplifies deployment for environments using Microsoft Intune or Group Policy.

The critical limitation is that WinRE does not update automatically through standard Windows Update cycles. The recovery environment is a separate software partition from the main operating system, and pushing a change into it requires deliberate action on every affected device. Organizations without centralized device management face the same manual, machine-by-machine process the advisory describes, with no automated delivery mechanism to fall back on.

Switching to TPM+PIN

Microsoft’s second option addresses the threat at a different layer. Devices currently using TPM-only BitLocker can be switched to TPM+PIN mode using PowerShell, the command line, or the Control Panel. Under TPM+PIN, the drive cannot decrypt at startup without a user-entered PIN, which means an attacker who triggers a WinRE shell still cannot read the volume without knowing that code. Microsoft’s guidance on configuring this mode is available in the BitLocker deployment and administration documentation.

For devices not yet encrypted, the guidance calls for enabling the “Require additional authentication at startup” policy through Intune or Group Policy and configuring the TPM startup PIN option to required. For those already encrypted in TPM-only mode, the switch to TPM+PIN can be completed without first decrypting the drive. Microsoft describes this as the more effective of the two options for blocking the current attack path.

The caveat that changes the calculus: Nightmare-Eclipse has publicly stated that a proof of concept bypassing TPM+PIN protection is being withheld and has not yet been released. If that claim is accurate and the researcher follows through, the second mitigation loses much of its protective value. Microsoft has not responded to that specific claim in its advisory language, and the withheld proof of concept remains unverified by independent researchers as of publication.

A Pattern Microsoft Has Seen Before

YellowKey is not the first BitLocker bypass to exploit the recovery environment. CVE-2022-41099, disclosed in November 2022, let attackers with physical access use WinRE to reach a disk encryption-protected volume through a different mechanism. The structural problem was identical: the fix required updating the WinRE image on already-deployed machines, and WinRE does not update automatically.

Microsoft shipped a patch for CVE-2022-41099’s WinRE bypass that required administrators to run a PowerShell script on each affected machine to push the correction into the recovery partition. The fix was not automatic. Many machines, particularly consumer devices and endpoints outside managed enterprise environments, never received the update at all. Security researchers who tracked that vulnerability noted adoption was poor, and the underlying delivery problem was never resolved.

The same structural constraint applies now. WinRE is a separate software image from the main Windows installation, and it does not receive corrections through normal cumulative patch delivery. A future Patch Tuesday update is expected to bake the current fix directly into WinRE images for new installations. But for the hundreds of millions of existing Windows 11 machines already deployed in the field, broad remediation will require the same type of deliberate, device-by-device action that produced inadequate adoption rates the last time this pattern played out, a dynamic Eclypsium’s researchers highlighted in their analysis of the YellowKey WinRE attack path.

The Case of the Unattended Laptop

BitLocker’s core promise is data protection for devices that leave their owner’s hands: a laptop taken from a hotel room, seized at a border crossing, handed to a repair technician, or stolen from an unattended bag. These are exactly the scenarios where physical access is available, credentials are not, and network connectivity is irrelevant. The exploit breaks that protection for any affected device configured in TPM-only mode, which is the default for many enterprise BitLocker deployments precisely because it allows a silent, PIN-free startup experience.

The exposed devices are not low-stakes. Executives, field engineers, legal and finance teams, and anyone whose laptop regularly leaves a managed office environment carry exactly the kind of sensitive data that disk encryption exists to protect. Many enterprise BitLocker deployments default to TPM-only mode because requiring a startup PIN creates friction for users and additional recovery overhead for IT teams. That convenience now has a measurable cost.

Organizations with unmanaged or consumer Windows 11 endpoints face a broader problem still. Even administrators who apply the registry fix to their managed fleet are operating with a mitigation, not a patch, and a mitigation that must reach every individual device before the exploit does. The gap between those two timelines is the actual exposure window.

The next scheduled opportunity for a permanent fix is the June Patch Tuesday release, the same cycle in which Nightmare-Eclipse has promised an unnamed “big surprise.” If Microsoft ships a full WinRE-baked update in June, the manual mitigation becomes a bridge rather than a long-term control. If it does not, every affected machine with a USB port stays a viable target through the summer with exploit code that is already published and requires no specialized skills to run.

NEWS

Moto G37 Power vs Oppo K14x vs Galaxy M17 5G: Which to Buy

Published

3 hours ago

May 23, 2026

Logan Pierce

Three 5G smartphones compete in Indian retail at prices from Rs. 14,499 to Rs. 18,999 as of May 2026: the Moto G37 Power with a 7,000mAh battery and Android 16 on board, the Oppo K14x 5G with 45W SuperVOOC fast charging, and the Samsung Galaxy M17 5G with a FHD+ Super AMOLED display and a six-year software support guarantee. Each phone wins a specific category. The question is which category matters most to the buyer making this decision.

Motorola’s G37 Power starts at Rs. 15,999 for 4GB+128GB, Rs. 1,000 above the Oppo K14x’s base and Rs. 1,500 above Samsung’s current ask for the same RAM-and-storage tier. At margins that thin, the hardware and software differences do the actual work of separating the three phones.

How the Prices Stack Up in India

None of the three phones occupies a standalone price tier. Oppo and Samsung overlap below Rs. 17,000, and the Moto G37 Power and Samsung share the Rs. 18,000-plus range. A buyer comparing 6GB configurations finds the Oppo K14x at Rs. 16,999 and the Galaxy M17 5G at Rs. 16,499, a Rs. 500 gap that makes the spec differences worth examining carefully.

Model	4GB Variant	6GB Variant	8GB Variant	On Sale Since
Moto G37 Power	Rs. 15,999	N/A	Rs. 18,999	May 25, 2026
Oppo K14x 5G	Rs. 14,999	Rs. 16,999	N/A	Feb 16, 2026
Samsung Galaxy M17 5G	Rs. 14,499	Rs. 16,499	Rs. 18,499	Oct 13, 2025

Samsung’s three-tier RAM ladder gives it the widest addressable range, from Rs. 14,499 to Rs. 18,499. Motorola skips the 6GB middle entirely, offering 4GB or 8GB only. For buyers comparing the 8GB tier, the G37 Power sits Rs. 500 above the Samsung at Rs. 18,999 against Rs. 18,499. Storage across all three variants starts at 128GB UFS 2.2 with microSD expansion up to 1TB, so capacity is not a differentiator here.

Moto G37 Power Oppo K14x 5G Samsung Galaxy M17 5G India specs comparison.

Display Technology: AMOLED Against LCD

Samsung’s Galaxy M17 5G is the only phone in this group with an AMOLED panel, and the advantage shows from the first use. Its 6.7-inch Super AMOLED screen resolves at FHD+ (1,080×2,340 pixels), producing true blacks through per-pixel shutoff and delivering contrast ratios that LCD cannot approach at any price. Brightness peaks at 1,100 nits in high brightness mode, protected by Corning Gorilla Glass Victus, a glass grade found on phones selling considerably above this price range. The trade-off is refresh rate: 90Hz, compared to 120Hz on both rivals. For social scrolling and daily navigation, 90Hz is smooth enough, but a side-by-side comparison shows a small perceptible difference in fluidity against a 120Hz panel.

Both the Moto G37 Power and the Oppo K14x 5G official specifications page confirm HD+ LCD panels at 120Hz, resolving at 720 pixels wide rather than 1,080. The G37 Power measures 6.67 inches with a 1,050-nit peak and Gorilla Glass 7i. Oppo’s display stretches to 6.75 inches at up to 1,125 nits, the brightest claimed figure in this group on paper. The resolution gap between HD+ and FHD+ is most apparent on fine text, small icons, and detailed photographs viewed up close. AMOLED’s per-pixel contrast, producing deep blacks that LCD cannot replicate, remains Samsung’s dominant visual advantage whenever the screen shows dark content or media.

The Galaxy M17 5G also carries Widevine L1 certification, allowing Netflix, Amazon Prime Video, and other streaming platforms to deliver HD-quality video to the device. Most budget LCD phones in this bracket receive only Widevine L3, which caps streaming resolution below HD regardless of the display’s native capability. For subscribers who stream video daily, this certification adds a practical layer of value beyond the panel type alone.

FHD+ Super AMOLED, 1,080×2,340, 90Hz, 1,100 nits HBM, Gorilla Glass Victus: Samsung Galaxy M17 5G
HD+ LCD, 720×1604, 120Hz, 1,050 nits HBM, Gorilla Glass 7i: Moto G37 Power
HD+ LCD, 720×1570, 120Hz, 1,125 nits peak brightness: Oppo K14x 5G

Battery Capacity and Charging Speed

The Moto G37 Power carries a 7,000mAh cell, the largest in this group by 500mAh over the Oppo K14x and 2,000mAh over the Samsung. On a 6nm MediaTek chipset running an HD+ display at 120Hz, that capacity comfortably covers two days of moderate use or a full heavy day with power to spare. Motorola includes 6W reverse wired charging, letting the G37 Power top up earbuds or a smartwatch via USB-C. The Oppo K14x also supports 5W reverse charging. Samsung’s Galaxy M17 5G includes neither function.

Oppo’s 45W SuperVOOC charger ships inside the retail box and fills the 6,500mAh cell in approximately 90 minutes from empty. For buyers who charge in short daily windows rather than overnight, this refill speed is a genuine advantage over the Moto G37 Power’s 30W included adapter and a bigger one over the Samsung’s 25W ceiling.

Samsung does not include a charger in the Galaxy M17 5G’s retail box. A compatible 25W USB-C PD adapter costs roughly Rs. 700 to Rs. 1,200 at retail, adding to the effective out-of-pocket cost for buyers who do not already own one. Despite the smaller 5,000mAh cell and slower charging rate, published real-world reviews consistently show the M17 5G delivering more than a full day of mixed use, partly because the Exynos 1330 draws less sustained power than the Dimensity chips under light-to-moderate workloads and the AMOLED panel’s pixel-off state conserves energy during dark-content playback.

Build weight splits along battery lines. The Moto G37 Power weighs 215 grams, noticeably heavier than the Galaxy M17 5G at 192 grams and the Oppo K14x at 212 grams. The larger cell accounts for most of that mass difference. Buyers sensitive to single-handed weight may find Samsung’s slimmer 7.5mm frame and lighter body a comfort factor worth considering alongside the raw battery figures.

Phone	Battery	Charging Speed	Charger in Box	Reverse Charging
Moto G37 Power	7,000mAh	30W wired	Yes	6W wired
Oppo K14x 5G	6,500mAh	45W SuperVOOC	Yes	5W wired
Samsung Galaxy M17 5G	5,000mAh	25W wired	No	No

Chipset, RAM, and Day-to-Day Performance

The MediaTek Dimensity 6400 (6nm) in the Moto G37 Power sits a step above the MediaTek Dimensity 6300 (6nm) powering the K14x 5G, offering slightly higher clock speeds and improved multi-core throughput. For everyday tasks, social feeds, streaming, messaging, and navigation, the gap is difficult to feel in use. Motorola offers 4GB or 8GB of LPDDR4x RAM with a virtual expansion ceiling of 12GB. Oppo provides 4GB or 6GB physical RAM, expandable virtually to 8GB. Both phones include 128GB UFS 2.2 storage with the same 1TB microSD cap, and both support RAM Boost-style virtual memory features to extend multitasking headroom.

Samsung’s Exynos 1330 (6nm) handles the Galaxy M17 5G with benchmark scores around 444,000 on AnTuTu v10, below both MediaTek chips on raw numbers, and real-world testing confirms occasional stuttering under heavy multitasking or sustained graphics load. For the everyday workload most buyers in this segment actually run, the Exynos 1330 is sufficient. Where the processor trails, One UI 7 compensates: Samsung bundles Circle to Search, Gemini Live voice assistance, and Voice Focus for call clarity, features absent from Motorola’s lighter Hello UI. Oppo’s ColorOS 15 adds AI Eraser for removing objects from photos and Dual-View Video, which fires the front and rear cameras simultaneously into a single shared frame.

Camera Systems Compared

Samsung builds the most versatile rear camera setup in this group. The M17 5G’s triple rear system leads with a 50MP OIS-equipped main sensor, supplemented by a 5MP ultrawide and a 2MP macro lens. OIS (Optical Image Stabilization) is uncommon at this price point: it absorbs hand tremor during handheld shots and video recording, producing sharper low-light stills and steadier footage compared to software stabilization alone. The 13MP selfie camera surpasses both rivals for portrait and video call detail.

Both the G37 Power and the Oppo K14x 5G use dual rear setups: a 50MP primary sensor paired with a secondary unit of limited practical value. Motorola’s second sensor combines ambient light sensing and flicker detection, offering no additional photography depth. Oppo’s 2MP monochrome sensor assists portrait processing in theory but adds little in typical shooting. The G37 Power’s 8MP front camera holds an edge over Oppo’s 5MP selfie shooter. All three phones shoot at least 1080p video from the rear; Motorola extends the ceiling to 2K at 30fps.

Samsung Galaxy M17 5G: 50MP OIS + 5MP ultrawide + 2MP macro (rear); 13MP (front). Triple camera, optical stabilization, the strongest low-light and video performer here.
Moto G37 Power: 50MP f/1.8 PDAF + 2-in-1 light sensor (rear); 8MP (front). Capable main shooter, no genuine ultrawide, solid selfie camera for the price.
Oppo K14x 5G: 50MP f/1.8 + 2MP monochrome (rear); 5MP (front). AI-assisted editing via ColorOS 15, weakest front camera of the three.

In daylight, all three 50MP main sensors perform comparably for casual photography. The gap widens after dark. Without OIS, the G37 Power and K14x rely on software processing and higher ISO to compensate for movement, raising the likelihood of blurred subjects in dim conditions. Samsung’s OIS absorbs the micro-tremors that software cannot correct, making it the safer choice for travel captures, indoor events, and anyone who regularly photographs in artificial light.

Software Support and Long-Term Value

Samsung’s update commitment is the Galaxy M17 5G’s defining competitive advantage. From its October 2025 launch date, Samsung confirms six OS upgrades (through Android 21) and six years of security patches, with support running until September 2031. That timeline typically belongs to flagship Galaxy S devices. Extending it to a sub-Rs. 19,000 M-series phone is a notable policy decision, and no rival here comes close to matching it at this price tier. For a buyer who holds a phone four or five years, the M17 5G’s effective cost per year of supported use is substantially lower than an equivalent-priced device that gets replaced after two.

Motorola’s G37 Power ships on Android 16, one version ahead of both rivals at their respective launch points, confirming an upgrade path to Android 17 and three years of security updates from May 2026. Starting on a newer Android release provides a meaningful head start in app compatibility and feature access during the first year, but the shorter patch runway means the G37 Power reaches end of active support while the Galaxy M17 5G remains in Samsung’s update cycle.

Oppo has not published a specific multi-year update schedule for the K14x 5G. The phone’s “48 months of fluency protection” is a performance-optimization guarantee, not an Android version delivery promise. Based on Oppo’s budget-tier history in India, the K14x will likely receive one to two Android version upgrades and three years of security patches, broadly in line with the MediaTek-based competition in this bracket. Buyers who use banking apps, VPN clients, or enterprise tools that enforce minimum Android version requirements will encounter that boundary within three years.

For buyers who upgrade every 18 to 24 months, update policy differences fade quickly inside that window. For everyone else, the Galaxy M17 5G at Rs. 14,499 pairs an AMOLED display, OIS camera, NFC, and a six-year software runway in a 192-gram body that neither rival in this comparison can match on combined long-term value.

Frequently Asked Questions

Which Phone Has the Best Display Among These Three?

The Samsung Galaxy M17 5G has the superior display. Its 6.7-inch FHD+ Super AMOLED panel produces true blacks, deeper contrast, and sharper text than the HD+ LCD screens on the Moto G37 Power and Oppo K14x 5G. The only trade-off is refresh rate: 90Hz on the Samsung against 120Hz on both LCD rivals. For most everyday use, including streaming, browsing, and social media, the picture-quality advantage of AMOLED outweighs the lower refresh rate.

How Long Will Each Phone Receive Software Updates?

Samsung’s Galaxy M17 5G is confirmed for six Android OS upgrades and six years of security patches from its October 2025 launch, meaning support runs through 2031. The Moto G37 Power is confirmed for one OS upgrade (Android 17) and three years of security updates from May 2026. Oppo has not published a formal update schedule for the K14x 5G; based on Oppo’s budget-tier history, the phone will likely receive approximately two OS upgrades over three years.

When Does the Moto G37 Power Go on Sale in India?

The Moto G37 Power goes on sale in India starting May 25, 2026, through Flipkart and Motorola’s India website. Both the 4GB+128GB variant at Rs. 15,999 and the 8GB+128GB variant at Rs. 18,999 will be available at launch.

Which Phone Has the Best Camera in This Comparison?

The Samsung Galaxy M17 5G carries the most capable camera setup. It is the only phone in this group with a triple rear camera system, a 50MP OIS main sensor, a 5MP ultrawide, and a 2MP macro, plus a 13MP selfie camera. The OIS-equipped main sensor reduces motion blur in low light and during video recording, an advantage the Moto G37 Power and Oppo K14x 5G cannot match at this price point.

Which Phone Charges the Fastest?

The Oppo K14x 5G charges the fastest at 45W SuperVOOC, with the charger included in the retail box. The Moto G37 Power supports 30W wired charging, also with the charger included. Samsung’s Galaxy M17 5G charges at 25W and does not include a charger in the box.

Do All Three Phones Support NFC?

The Moto G37 Power and Samsung Galaxy M17 5G both include NFC for contactless payments through Google Pay, PhonePe, and similar platforms. The Oppo K14x 5G does not include NFC, which is a meaningful gap for users who rely on tap-to-pay or transit card payments.

Which Phone Has the Most Durable Build?

The Moto G37 Power is the most ruggedized of the three, combining an IP64 dust-and-splash resistance rating with MIL-STD-810H military-grade drop certification. The Oppo K14x 5G also holds an IP64 rating without the MIL-STD certification. The Samsung Galaxy M17 5G has a lower IP54 rating but uses Corning Gorilla Glass Victus on the front, the strongest screen glass in this group.

GAMING

Deadlock May 22 Patch Overhauls Soul Urn and Nerfs Victor

Published

3 hours ago

May 23, 2026

Logan Pierce

Valve’s May 22 Deadlock patch replaced the Soul Urn’s two-second pickup channel with a single melee strike and moved every deposit to the center bridge, where opponents now have a live window to steal the objective before souls confirm. The update reached more than 30 heroes, brought a new Tier 1 Vitality item called Grit into the shop, and restructured the upgrade paths for Sharpshooter and Ballistic Enhancement.

The numbers behind the urn changes are not subtle. Carry time before damage kicks in fell from 45 seconds to 35, and the penalty climbed from 0.15% max HP per second to a flat 5% max HP per second, which is lethal at any HP total. Valve wants the urn moving and teams contesting the drop-off, not stringing along a solo courier for the entire back half of a match.

The Soul Urn Overhaul

How Pickup Changed

The old channel demanded two seconds of standing still. An enemy melee or stun reset the timer completely, turning contested spawn points into a war of interrupts on both sides. Under the new system, one light or heavy melee swing collects the urn with no channel and no interrupt risk at the moment of pickup.

A harder cutoff now applies once the urn gets fumbled. If it sits on the ground for 13 seconds without anyone within 25 meters, pickup locks permanently for that spawn and the urn sprints back to its original position automatically. Teams could previously hover near a fumbled urn to set up extended recovery plays; that option is gone.

The Depositing Phase Window

Before this patch, delivery happened deep on the opposite side of the map, in territory the carrying team had to cross while revealed on the minimap. The drop-off now sits at the center bridge, the same location for both teams. Once the courier steps onto the drop-off, the urn enters a “Depositing” phase rather than converting immediately.

The depositing timer scales with game state: three seconds when the delivering team is Favored, five seconds in neutral games, and ten seconds when the Unfavored team delivers in comeback mode. Any enemy player can heavy melee the urn during this window to flip ownership to their team, adding 1.25 seconds to their own deposit counter. The last person to contest before the deposit finalizes earns the +3 Golden Idol buffs; if nobody challenges, the original carrier takes them instead. Souls pay out in full the moment deposit completes.

Carry Conditions Revised

Two carrier-specific protections were stripped. The urn no longer silences the courier, though the disarm and movement silence remain. The passive +30% Bullet and Spirit Resist that made tanky heroes dominant in the courier role is gone entirely. In its place, the team with the stronger position (Favored or Unfavored in comeback mode) now receives +50% Bullet and Spirit Resist in a 60-meter radius around the urn while it is being carried, dropped, or sitting in the depositing phase.

The protection now spreads to any teammate within range rather than locking to the courier alone. Escort compositions benefit directly. Solo fast-runner strategies do not. Bringing your team to the center bridge is no longer optional.

Mechanic	Before This Patch	After This Patch
Pickup method	2-second standing channel	Single light or heavy melee
Delivery location	Opposite side of map	Center bridge, same for all teams
Carrier silence	Full silence while carrying	Disarm and movement silence only
Carrier resist bonus	+30% Bullet/Spirit Resist on courier	Removed; team area bonus applies instead
Damage timer onset	45 seconds aggregate carry time	35 seconds aggregate carry time
Damage rate	0.15% max HP per second	5% max HP per second (lethal)
Deposit contest window	None at drop-off	3s/5s/10s phase; heavy melee flips ownership

Deadlock Soul Urn contested objective overhaul in May 22 patch notes.

Map Pressure and Pacing Shifts

Base HP fell by 10 for every hero, and HP per boon dropped by 3. These are not dramatic numbers in isolation, but combined with the urn’s faster damage onset they narrow the margin on dive trades and nudge sustain itemization earlier. Several objective timers moved alongside those stat cuts, compressing the early game at multiple points simultaneously. The official Deadlock May 22 gameplay update on Steam contains the complete changelist.

Midboss now spawns at the game’s start, present from minute one rather than entering mid-match.
Medium neutrals appear one minute earlier, at the five-minute mark instead of six.
Breakables push back one minute, spawning at three minutes instead of two.
Shrines are invulnerable until a pair of Base Guardians falls, closing the backdoor until a lane collapses completely.
Guardian scaling resistance shifted from +75% to -50% over 12 minutes to +50% to -50%, meaning guardians absorb more punishment in the first several minutes.
Backdoor removal linger cut from 20 seconds to 14, shortening how long protection persists after an ally leaves the area.

Two outward-pointing jump pads near the map’s center were removed, tightening rotation paths between lanes. Sliding no longer resets sprint speed, and wall jumps now impose a 25% stamina regen reduction for five seconds, adding a small but real cost to the aggressive chase-and-disengage loop that dominates mid-game skirmishes.

The pacing shifts in numbers:

10 HP removed from every hero’s starting health pool
35 seconds of aggregate urn carry time before lethal damage begins (down from 45)
5 minutes first medium neutral spawn, one minute earlier than before
14 seconds backdoor removal linger, trimmed from 20

Bullet Velocity now stacks additively instead of diminishingly. Heroes building multiple velocity items gain more from each additional source, a quiet mechanical change that strengthens ranged-carry builds relative to short-range fighters who never invest in velocity at all.

Grit and the Item Ladder

The new Tier 1 Vitality item, Grit, enters the shop as an early survivability option. Its active drops a 200 Barrier for four seconds on a 60-second cooldown, and the innate provides one Out of Combat Regen. Grit builds into Weapon Shielding, Spirit Shielding, Reactive Barrier, and Guardian Ward. None of those upgrades inherit the manual active cast from the component, but all gain Out of Combat Regen from it.

Weapon Shielding and Spirit Shielding each picked up an 18% resistance proc for their respective damage type on activation, trading away the old move speed bonus. Both items now function as direct defensive purchases rather than speed-utility hybrids, and Weapon Shielding in particular becomes a sharper answer to bullet-heavy team compositions.

Sharpshooter gained a second upgrade path from High-Velocity Rounds in addition to Long Range, picking up +60% Bullet Velocity and an innate 10% Weapon Damage from components. Ballistic Enhancement now upgrades from Mystic Expansion, rerouting a previously freestanding purchase into a cleaner build flow. Both path changes reshape how weapon-focused heroes plan mid-tier item progression.

Other notable item adjustments from the patch:

Indomitable received +2 Out of Combat Regen, with both Bullet and Spirit Resist growing from 8% to 10%.
Golden Goose Egg permanent buff now triggers every 80 souls instead of every 100, making the scaling stat meaningful earlier in a game.
Magic Carpet innately grants -15% Gravity and +25% Air Control, giving mobile heroes a stronger default utility floor.
Shadow Weave extended its duration from 10 seconds to 13 and raised all three ambush bonuses (Fire Rate, Spirit Power, Melee Damage) from 20% to 25%.
Glass Cannon’s max health penalty reduced from -15% to -13%, a modest concession for aggressive compositions running it.

The Weapon, Vitality, and Spirit Investment Bonus schedules each added a new 6,400-soul tier, inserting a breakpoint between the existing 4.8k and 7.2k steps and reducing the gap to the first meaningful power bump in the mid-game.

Heroes Gaining Ground

Graves and Grey Talon received the most extensive mechanical reworks, though Rem’s Tag Along overhaul and a collection of damage-dealer upgrades also shift the tier picture in meaningful ways.

Graves: Sprint speed raised from 1.6 to 2.2. Grasping Hands now spawns a ghoul in the base ability rather than requiring Tier 3. Seven bug fixes and improved Deadheads movement rounded out the overhaul; bullet damage and growth were cut by 10% to offset the mobility gains.
Grey Talon: Rain of Arrows cooldown dropped from 30 seconds to 22, cast delay fell from 0.5 to 0.2 seconds, and stamina distance flipped from -9% to +25%. Duration was trimmed from seven seconds to four, but the T1 and T2 tier placements swapped to deliver weapon damage and slow earlier in the upgrade path.
Rem: Tag Along received eight separate improvements, including 50% faster travel to allies, secondary ally burst healing, veil casting support, friendly aura passthrough, and post-eject lockout reduced from 1 second to 0.3 seconds. Naptime base damage reduction increased to 30%.
Abrams: Infernal Resilience T2 changed from +200 max health to +18% Melee Lifesteal, a direct upgrade for dive-and-sustain builds.
Holliday: Base bullet damage raised from 18.8 to 19.7, and health regen doubled from 1 to 2.
Viscous: Puddle Punch T2 traded +30 damage for +40% Lifesteal, strengthening sustained brawls over burst exchanges.
Paradox: Time Wall T3 now grants +2 charges instead of +1, with charge delay halved from 4 to 2 seconds. Paradoxical Swap base damage rose from 125 to 150.

Billy, Venator, and Paige also picked up positive adjustments. Paige’s Rallying Charge now runs at half cooldown when it connects with neither allies nor enemies, improving its reliability as a rotation tool in situations where the full team is not present.

Heroes Facing Damage Nerfs

Victor took the sharpest adjustment. Base bullet damage dropped from 13+0.3135 to 12+0.26, reducing both his starting floor and his scaling ceiling. Aura of Suffering now deals 50% of its value against objectives, removing him from the top tier of reliable structure-clearers. His Jumpstart T3 spirit scaling improved from 0.6 to 0.9, but that is a late-game adjustment that does not offset the carry damage reduction in most matches.

Several other high-performing heroes absorbed reductions to their primary scaling:

Hero	Key Nerf
Bebop	Bullet damage per boon 0.139 to 0.115; Exploding Uppercut T2 weapon damage +40% to +30%
Seven	Bullet damage growth 0.374 to 0.337; crit reduction raised from 35% to 55%
Warden	Bullet damage per boon 0.38 to 0.34; Binding Word T2 loses +12m cast range
Shiv	Killing Blow cooldown extended from 105s to 125s; full rage damage bonus reduced from 14% to 12%
Kelvin	Arctic Beam DPS spirit scaling 0.5 to 0.38; Frost Grenade spirit scaling 0.7 to 0.6
Dynamo	Kinetic Pulse spirit scaling 1.65 to 1.55; Quantum Entanglement T3 reduces debuffs 50% rather than dispelling them

Apollo’s Riposte lost its automatic dash on parry. It now grants a sub-ability that lets the player manually target a hero within 25 meters, with a brief window to choose before the ability expires. Players can buffer the target before the parry lands, which raises the mechanical ceiling while keeping the ability competitive for those who adapt.

The center-bridge depositing window is where this patch will be stress-tested. In organized play, five seconds to contest a neutral urn is enough time for a coordinated five-man response. In solo queue, that window will tend to reward the team that happens to be closer and punish whoever sent their roster somewhere else at the wrong moment. If contest rates stay low and deposits go uncontested routinely, Valve has already demonstrated with the carry damage timer that it is willing to apply sharper pressure; the 3s/5s/10s window, the 1.25-second contest bonus, and the lethal carry damage are three independent variables it can tune before the next patch lands.

NEWS

Gaggan Anand Bets on Scarcity Over Instagram With Raga Delhi

Published

4 hours ago

May 23, 2026

Logan Pierce

Gaggan Anand, founding chef of the Bangkok restaurant that holds the Asia’s 50 Best Restaurants top position for the fifth time, is targeting a July opening for Raga in New Delhi: 40 seats, a tasting-menu-only format, and a fully open kitchen on Janpath, five minutes from the Prime Minister’s residence. Twenty years after leaving India, his return carries a philosophy shaped across the Gulf of Thailand: phones are not tools at a tasting counter, they are thieves of experience, and the best way to fill a table is to tell people they cannot photograph what happens at it.

That philosophy now meets the one dining ecosystem least likely to absorb it without friction. India’s independent fine dining scene grew on Instagram. Its most celebrated new chefs built national audiences through plating videos and award ceremony posts. Whether Raga earns its place in that hierarchy through social visibility, or survives by importing the anti-social-media stance built in Bangkok, is the opening-night question nobody at Friday’s Mumbai panel answered directly.

The Phone Ban as Anti-Marketing

At a session in Mumbai last Friday, part of the Khatta Meetha culinary series he launched with Masque and Culinary Culture, the chef traced the no-phone policy back to Bangkok in 2007, before food reels existed and a reservation wasn’t drivable by a stranger’s photograph. Discovery was slow, honest, and contingent on actually going. Then social media changed the incentive structure for both diners and restaurants, and something broke in return.

The specific break was the influencer crowd. They came to his Bangkok restaurant to document, not to eat. His restaurant is a theatre, he said, and in the middle of a theatrical performance, diners were repositioning plates for angles, touching garnishes that were falling apart, pointing phones at ice cream while the dish deteriorated on the plate. The experience became secondary to the content it could generate.

Do you know how many people will come when you ask them not to use their phone? This is anti-marketing. When they can’t, they will feel deprived. So they will come for that, and that’s when I will give them an experience.

Anand, speaking on a panel at Bar Paradox moderated by Raaj Sanghvi, compared the logic to a live concert. You paid to see the artist. Now you spend the show filming it for someone else to watch on YouTube. He wanted one restaurant in the world, at his level of recognition, run by an Indian chef, that says no to phones.

That restaurant is Gaggan in Bangkok, rebuilt in 2026 as a 14-seat, four-days-a-week venue where meals run 180 minutes and phones are physically unavailable for most of the experience. The new menu moves through the seven chakras: seven colours, seven lights, seven acts. Filmmaker Aditya Chopra, who attended the chef’s residency at Masque Lab in Mumbai the previous evening, appreciated the no-documentation atmosphere, Anand noted at the session. Chopra is not on social media.

Gaggan Anand Raga restaurant New Delhi phone ban tasting menu July opening.

Rydo Anton, the Chef Raga Is Built Around

The name stitches two surnames together: RA from Rydo Anton and GA from Gaggan, producing the Hindi word for a classical melodic framework built for improvisation within structure. Chef Rydo Anton, an Indonesian-born cook who has worked in Gaggan’s kitchens for 14 years, traveled to India roughly 200 times in preparation for this project. He ran the Bangkok kitchen with the same operational responsibility as the founding chef through multiple award cycles, holding a top-10 global ranking alongside him for years.

The restaurant exists partly because of a retention problem that Anand solved in the most direct way available. When Anton took over full operational control and proved himself at scale, the possibility of losing him to another project became real. “When I made him the head chef, he proved everything I thought about him,” the chef said at the Mumbai session. “Then there was a point when I thought he might leave me.” The two scouted Indonesia as a possible base and traveled there without finding the right fit. When partnership talks with Zorawar Kalra, founder and managing director of Massive Restaurants, the hospitality group behind Masala Library, Farzi Café, and Pa Pa Ya, moved forward, Anand offered Anton equal ownership of Raga.

He reached for Jiro Ono, the Tokyo sushi master whose restaurant bans photography and whose son will eventually surpass him technically, as the framing device. You still go to see Jiro. That pilgrimage is a legacy question, not a skills assessment. Anton will be the face of Raga’s kitchen every service. The founding chef brings the global name, the accumulated context, and the co-dependency that kept them working together long enough to design this restaurant.

The Raga Blueprint in Delhi

Raga occupies two levels on Janpath, one of New Delhi’s most diplomatically loaded addresses, with embassies in the immediate perimeter and the Prime Minister’s residence a short walk away. The ground floor holds a fully open kitchen; the upper level contains a private dining room. Dinner-only at launch, tasting menus as the sole format, no à la carte fallback in the initial configuration. Kalra described trips to Japan with the founding chef to commission custom crockery from artisans, with the equipment budget exceeding what most Indian restaurants spend on a complete refurbishment.

Feature	Raga (New Delhi, targeting July 2026)	Gaggan (Bangkok)
Seat count	40	14
Menu format	Tasting menu only, dinner service	Multi-course dinner, chakra structure
Kitchen layout	Fully open, ground floor	Open kitchen, chef-centred
Private dining	Upper floor room	Not publicly confirmed
Phone policy	No stated ban	Banned during most of the meal
Indicated price	Rs 8,000++ (unconfirmed at launch)	Up to Rs 50,000 equivalent
Daily kitchen face	Rydo Anton (co-owner)	Gaggan Anand
Business partner	Zorawar Kalra (Massive Restaurants)	Independent operation

Pricing remained publicly undefined at the Mumbai session. Masque, the tasting-menu restaurant Aditi Dugar founded and runs in Mumbai, widely regarded as India’s most expensive non-hotel dining room at Rs 8,000++ per head, is the natural reference point. Kalra described the brand as “invaluable” and deferred entirely to the founding chef on seat pricing. The Janpath real estate and artisan equipment spend suggest the number will land at or above Masque’s benchmark.

When Screen-Free Sells

The 14-seat Bangkok venue’s no-phone stance is no longer a solo position globally. Restaurants and bars across at least 11 U.S. states now operate some form of phone restriction, from Charlotte, North Carolina’s Antagonist cocktail bar, which places phones in locked pouches for two hours, to Delilah’s, an upscale supper-club chain with locations in Dallas, Las Vegas, Los Angeles, and Miami that operates a strict no-phones, no-posting policy. Washington D.C. has the highest concentration of such venues in the country, per reporting from April 2026.

63% of Gen Z adults said in a December 2025 Talker Research survey, commissioned by ThriftBooks, that they intentionally disconnect from devices.
57% of millennials report the same deliberate unplugging behaviour, ahead of Gen X at 42% and baby boomers at 29%.
144 times per day is the average number of phone checks among Americans, per Consumer Affairs data, the environment phone-free tasting menus are explicitly betting against.
4.5 hours of average daily screen time: the attention budget a 180-minute, phone-free dinner is asking diners to redirect toward the plate.

The commercial logic runs alongside the experiential argument. Unplugged diners are more likely to order additional courses and a second drink, according to Amanda Belarmino, a hospitality professor at the University of Nevada, Las Vegas, cited in recent industry commentary on the phone-free trend. At a tasting-menu restaurant the connection is structural: a phone distraction mid-course is not a brief interruption, it is a puncture in a narrative the kitchen spent hours building.

The trend concentrates at high-end tasting-menu venues and supper clubs, where a single narrative experience replaces a conventional menu of individually ordered dishes. The policy is becoming a differentiator rather than a deterrent. Younger diners, the generation that built the influencer economy, are also the generation most actively trying to escape it for a few hours, and the data is consistent enough that hospitality groups are treating it as a commercial signal, not a philosophical stance.

India Is a Different Test

The Instagram Economy That Built Indian Fine Dining

India’s current wave of independent fine dining did not arrive quietly or without documentation. Masque built years of audience through careful plating photography, international award coverage, and digital word-of-mouth that could place a Mumbai restaurant on the radar of someone who had never left Bengaluru. The four chefs Anand himself named at the Mumbai session as the best practitioners of Indian cuisine today, Pradeep Sharma, Manish Mehrotra, Prateek Sadhu, and Niyati Rao, became nationally recognised figures through a combination of critical writing and sustained social visibility. The platform that made them famous is the same one Anand is publicly questioning.

Raga opens in a market where its target audience has no direct experience of Anand’s cooking on Indian soil, making initial social awareness critical during the first weeks of service.
India’s restaurant awards circuit depends significantly on critic and influencer attendance to validate new openings as culturally significant rather than commercially calculated.
The Rs 8,000++ price band requires a client base that was built, in Masque’s case, over years of deliberate digital presence and media coverage, not simply a famous name.
No phone ban is planned at Raga, per the chef’s stated intent to apply that policy to one restaurant only, placing the Delhi opening squarely inside the same social ecosystem he criticises at every interview opportunity.

Why Scarcity Might Travel Anyway

The counter-case lives in his own logic. Scarcity and denial, the chef argued at Mumbai, outperform visibility as marketing tools. The inability to document a meal creates more desire than the ability to share it. At the Mumbai session, reflecting on his own early-career hunger, he said, “When I started Gaggan at 32, I was desperate. I wanted Vir to write about me. I wanted everyone to post about me.” That hunger built the global profile he carries into Raga. The question is whether the same engine can seed a brand that opens on reputation rather than building from scratch, and whether word-of-mouth will get time to work before the influencer economy tries to define the restaurant first.

The Asia’s 50 Best Restaurants ranking and the Masque Lab residency that drew Aditya Chopra and Rani Mukherjee the night before the Mumbai panel both point to the same audience, one that wants to eat without performing the act of eating. Chopra appreciated the no-documentation atmosphere, the chef noted. Mukherjee does not use WhatsApp. Both are figures for whom privacy at the table is a feature, not a friction. If Raga’s first weeks draw that quality of diner, the anti-social-media philosophy will have transferred to India without a formal rule to enforce it. If the opening generates an Instagram queue instead, the founding chef will face precisely the dynamic he built his Bangkok policy to avoid.