Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

**Executive summary:** An anonymous researcher disclosed two new zero-days — YellowKey, a BitLocker bypass that leverages specially crafted FsTx files replayed from a USB/EFI partition to obtain a shell during WinRE boot (bypassing TPM+PIN), and GreenPlasma, an incomplete PoC for a CTFMON privilege escalation allowing arbitrary section creation in SYSTEM-writable directory objects; the report also recounts a boot manager downgrade attack (CVE-2025-48804) that enables BitLocker compromise and recommends mitigations such as enabling BitLocker PIN/preboot authentication and migrating/revoking legacy boot manager certificates.