Anonymous researcher Chaotic Eclipse, also known as Nightmare-Eclipse, has released proof-of-concept exploits and technical details for two (2) new Windows zero-days dubbed YellowKey and GreenPlasma, continuing a public disclosure campaign that previously exposed the BlueHammer, RedSun, and UnDefend Microsoft Defender flaws. YellowKey is a BitLocker bypass affecting Windows 11 and Windows Server 2022/2025 that abuses NTFS transactional logging and the Windows Recovery Environment (WinRE) to launch a command shell with access to an unlocked BitLocker-protected drive. The exploit uses specially crafted FsTx files placed on a USB device or EFI partition to manipulate recovery behavior and replace the normal WinRE interface with cmd.exe. Independent researchers Kevin Beaumont and Will Dormann confirmed key aspects of the attack, with Dormann noting that NTFS transaction replay from one volume appears capable of modifying files on another volume. While the currently released exploit mainly impacts TPM-only BitLocker deployments and requires physical access to the original device, Chaotic Eclipse claimed the underlying flaw could also affect TPM+PIN configurations. The second vulnerability, GreenPlasma, targets the Windows Collaborative Translation Framework (CTFMON) and allows arbitrary memory section creation within SYSTEM-writable directory objects, potentially enabling privilege escalation to SYSTEM by manipulating trusted services or drivers. Although the PoC is incomplete, the researcher suggested it could be adapted into a full privilege escalation exploit. The disclosures have renewed concerns around BitLocker protections, particularly after researchers from Intrinsec demonstrated a downgrade-based BitLocker bypass using CVE-2025-48804 and older signed Windows boot manager binaries to defeat encryption protections on fully patched Windows 11 systems. CTIX analysts recommended following the guidance by enabling BitLocker preboot PIN authentication and revoking legacy PCA 2011 boot certificates to reduce exposure.