A zero-day exploit circulating online allows people with physical access to a Windows 11 system to bypass default BitLocker protections and gain complete access to an encrypted drive within seconds.

The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM). BitLocker is a mandatory protection for many organizations, including those that contract with governments.

When one disk volume manipulates another

The core of the YellowKey exploit is a custom-made FsTx folder. Online documentation of this folder is hard to find. As explained later, the directory associated with the file fstx.dll appears to involve what Microsoft calls the transactional NTFS, which allows developers to have “transactional atomicity” for file operations in transactions with a single file, multiple files, or ones that span multiple sources.

The steps for carrying out the bypass are simple:

1. Copy the custom FsTx folder from the Nightmare-Eclipse exploit page to an NTFS- or FAT-formatted USB drive
2. Connect the USB drive to the BitLocker-protected device
3. Boot up the device and immediately press and hold down the [Ctrl] key
4. Enter Windows recovery

There are at least two ways to accomplish the third step. One way is to boot into Windows, hold down the [Shift] key, click on the power icon, and click restart. Another is to power on the device and restart it as soon as Windows starts booting.

In either case, a command (CMD.EXE) prompt appears. The prompt has full access to the entire drive contents, allowing an attacker to copy, modify, or delete them. In a normal Windows Recovery flow, the attacker would need to enter a BitLocker recovery key. Somehow, the YellowKey exploit bypasses this safeguard. Multiple researchers, including Kevin Beaumont and Will Dormann, have confirmed the exploit works as described here.

It’s unclear what in the custom FsTx folder causes the bypass. Dormann said that it appears to be related to Transactional NTFS, which itself uses command-log file system under the hood. Dormann further noted that by looking at the Windows fstx.dll, one will see code that explicitly looks for \System Volume Information\FsTx in the FsTxFindSessions() function.”

The contents of this FsTx directory used in the YellowKey exploit reveal no strings related to RecoverySimulation.ini. It does, however, show the files and paths \??\C:\Windows\win.ini and

\??\X:\Windows\System32\winpeshl.ini, “where X:\Windows\System32\winpeshl.ini is what controls what WinRE [Windows Recovery] does when it fires up.”

Dormann, who is a senior principal vulnerability analyst at Tharros Labs, continued:

But what’s intriguing to me is: Why can the presence a \System Volume Information\FsTx directory on one volume affect the contents of ANOTHER VOLUME when it’s replayed? 🤔

In a normal WinRE session, you have a X:\Windows\System32 directory that has a winpeshl.ini file in it:

[LaunchApp]

AppPath=X:\sources\recovery\recenv.exe

However, with the YellowKey exploit, it looks like Transactional NTFS bits on a USB Drive are able to delete the winpeshl.ini file on ANOTHER DRIVE (X:). And we get a cmd.exe prompt, with bitlocker unlocked instead of the expected Windows Recovery environment. While the TPM-only Bitlocker bypass is indeed interesting, I think the buried lede here is that a \System Volume Information\FsTx directory on one volume has the ability to modify the contents of another volume when it is replayed. To me, this in and of itself sounds like a vulnerability.

A Microsoft representative declined to answer questions sent by email about the reported vulnerability other than to say the company is investigating.

People should know that at the moment, BitLocker on Windows 11 isn’t providing the protection it’s supposed to. That means stolen or lost devices can still be accessed even when BitLocker is enabled.

This bypass works only in the Windows 11 default mode of BitLocker, which stores decryption keys in the TPM. This TPM-only configuration has long been considered insufficient by many security professionals, who instead advise that a PIN should be required before the key can be retrieved from the TPM. Beaumont advised people to enable a BIOS password lock to prevent YellowKey attacks. While using BIOS password locks is a good practice, it’s unclear how they provide any protection against this particular exploit.

Following a quarter in which his company delivered record revenue, Cisco CEO Chuck Robbins announced that the company’s latest round of layoffs begins today.

In a blog post yesterday, Robbins was quick to boast that Cisco’s fiscal Q3 2026 earnings saw revenue increase 12 percent year-over-year to $15.8 billion. He told employees that he and the rest of Cisco’s executive leadership team “could not be prouder of the growth you have all delivered for Cisco.”

But that pride could apparently not save the company’s successful employees from unemployment.

“We are making changes today that will result in the reduction of our overall workforce in Q4 by fewer than 4,000 jobs, representing less than 5 percent of our total employee base,” he wrote. “Most notifications will begin on May 14 and continue globally in alignment with applicable local laws and regulations.”

As with many layoffs at tech companies recently, Cisco’s job losses are attributed to the growth of AI. Robbins’ blog noted that companies that “will win in the AI era” need to demonstrate the “focus, urgency, and the discipline to continuously shift investment toward the areas where demand and long-term value creation are strongest.”

“This means making hard decisions—about where we invest, how we’re organized, and how our cost structure reflects the opportunity in front of us,” Cisco’s chief said.

Cisco plans to turn the layoffs into investments in “silicon, optics, security, and in our employees’ use of AI across the company,” according to Robbins.

In its earnings report released on Wednesday, Cisco said it sold $5.3 billion in AI infrastructure from hyperscalers so far this fiscal year. It is now expecting orders for the fiscal year to reach $9 billion, up from $5 billion, and revenue to reach $4 billion instead of $3 billion.

During a call with investors on Wednesday night, Cisco executives discussed the layoffs further, with CFO Mark Patterson saying, “This was really not a savings-driven restructure,” according to a transcript of the call.

“Things are moving incredibly fast right now,” he said. “And this is more realigning from an already strong base, as you’re seeing in our financials, but really realigning resources around silicon, optics, security, and AI. And so being able to move fast, we don’t always have the exact resources that we need going forward in the right places. And so that’s really what this is about versus savings.”

Due to the layoffs, Cisco expects to “recognize up to $1 billion of pre-tax charges with $450 million to be recognized in the Q4 FY ’26 and the remainder during FY ’27,” Patterson added.

“These [layoffs] are building from a position of strength and focusing on the technologies that will accelerate our growth, deliver unmatched innovation to customers and partners, and define our future,” Robbins said on the call.

Bonuses and training for laid-off workers

Robbins’ blog post said that affected workers will receive “pro-rated payment” of fiscal 2026 bonuses. The company also says it will offer services to help laid-off employees find new jobs.

“We will provide support in finding new opportunities, whether internal or external, through Cisco’s placement services—a program that has seen 75 percent of participants discover their next role,” Robbins said. “We are also committed to continued personalized learning and will provide one year of access to all Cisco U courses and certifications, covering AI, security, networking, and more.”

This round of layoffs follows the dismissal of 4,245 employees, or 5 percent of the workforce at the time, in February 2024, and about 6,000 people, or about 7 percent of the workforce, in August 2024. Cisco also attributed the latter layoffs to the need to restructure around AI and security, The Register reported at the time.