Security researchers at Intrinsec released "BitUnlocker," a tool bypassing Windows 11 BitLocker encryption in under five minutes. This exploit leverages a downgrade attack to pry open drives, exploiting the gap between software patching and certificate revocation. Rooted in CVE-2025-48804, a vulnerability patched in July 2025, the flaw resides within the Windows Recovery Environment and System Deployment Image mechanism. Here's the good news: an attacker needs physical access to the target machine.

Attackers with physical access can use a flash drive to feed the boot manager a legitimate Windows Imaging Format file for integrity checks while appending a malicious payload. The system verifies the clean file but blindly boots the attacker's code, granting access to the decrypted volume. The true danger lies in the downgrade vector. Because Microsoft's legacy Windows PCA 2011 certificate remains globally trusted by Secure Boot, attackers simply load an older, vulnerable boot manager, which the system authenticates without hesitation.

Microsoft is... giving users exactly what they want? In the latest Windows Insider preview for Windows 11, Microsoft is rolling out an updated Windows Update experience that gives users more control over their update process. This includes the option to skip updates entirely during the out-of-box experience (OOBE) menu, allowing you to set up a PC without applying updates first. Previously, new PC configurations and installations might have been several months behind on Windows 11 updates, and Microsoft would force users to apply these updates immediately. This led to prolonged OS setup times and user frustration. Now, for those who need to move to a new desktop quickly and apply updates at a later date, Microsoft is finally offering an option during OOBE to install the OS first and apply updates later.

Additionally, Microsoft is now allowing users to pause Windows 11 updates in the settings with a dedicated calendar that extends up to 35 days. This ensures you have ample time to schedule an update session without disrupting your workflow. However, the 35-day mark is not a hard stop, as users can re-pause updates for another 35 days even after the original period has expired, essentially allowing updates to be paused indefinitely. There are no limits on how many times you can reset this pause date, giving you full control over the entire update process. This could be especially useful when a new update series arrives, and you want to wait and see if there are any OS issues or known problems before applying the update. For example, in the latest Windows 11 April update, some PCs might experience a BitLocker trigger, but this will be resolved in a future fix. Users can wait a few days for a fix to arrive and then install updates all at once without being forced to do so immediately.

It has been a while since one of Microsoft's Windows 11 updates wreaked havoc among PC enthusiasts, and the April update seems to be another in line for IT administrators. In an updated support document on the Windows 11 KB5083769 cumulative update, Microsoft officially confirms that some users are encountering an unexpected BitLocker recovery prompt after applying the update. However, the good news is that this issue requires a specific BitLocker Group Policy configuration that Microsoft refers to as "unrecommended," which is less likely to be found outside of managed IT departments. This includes systems managed through group policy settings, making it less likely to affect PC enthusiasts' builds. For the issue to occur, a few conditions must be met. First, BitLocker must be enabled on the PC. Second, the BitLocker Group Policy setting "Configure TPM platform validation profile for native UEFI firmware configurations" must be configured with PCR7 (a TPM 2.0 module register) included in the validation profile.

Once these conditions are met, running system information, or msinfo32.exe, shows that the Secure Boot State PC47 Binding is "Not Possible." Additionally, the Windows UEFI CA 2023 certificate must be present in the device's Secure Boot Signature Database (DB), making the device eligible for the Windows Boot Manager signed in 2023 to become the default. Finally, the device must not be running this 2023-signed Windows Boot Manager that it supports. Only by fulfilling this unusual set of conditions does the BitLocker Recovery environment trigger, leading to a password prompt. After this, subsequent startups will not trigger it again.

Microsoft has confirmed that the company complied with the request of the United States Federal Bureau of Investigation (FBI) to give away BitLocker encryption keys for unlocking customer data on three laptops. According to Forbes, early last year FBI handed a warrant to Microsoft for recovery keys that are protecting three laptops from the Guam area, which were running Microsoft's BitLocker encryption on their drives. For those unaware, BitLocker uses 128 and 256-bit AES encryption over entire drive volumes, so the data becomes unusable once it is out of user's hands. Only a generated key can unlock the data with the exact combination, making it impossible for third-parties to unveil what is happening inside the storage volume.

However, now Microsoft spokesperson Charles Chamberlayne has confirmed for The Verge that the every BitLocker key generated for the local device usage is also stored in Microsoft's online storage server. He continued elaborating that "customers can choose to store their encryption keys locally, in a location inaccessible to Microsoft, or in Microsoft's cloud. We recognize that some customers prefer Microsoft's cloud storage so we can help recover their encryption key if needed. While key recovery offers convenience, it also carries a risk of unwanted access." However, having these encryption keys stored online is a massive security vulnerability, as personal privacy can be circumvented in case a government body like FBI requests the key.

Microsoft has unveiled a new hardware-accelerated BitLocker encryption system for Windows 11, which shifts cryptographic operations from software to dedicated accelerator units integrated into future CPU microarchitectures. Historically, software-based BitLocker in Windows 11 has caused massive performance degradation. For example, in Windows 11 going from no BitLocker to software-based BitLocker has caused average number of cycles per I/O to skyrocket from roughly 400,000 cycles to about 1.9 million cycles. This is a 375% increase in cycles per I/O, and can cause significant storage performance degradations. However, Microsoft is finally bringing hardware-based encryption to solve this.

The new hardware acceleration, announced at Ignite 2025 in November, is now available in Windows 11 version 25H2 and Windows Server 2025 with the September update. Early testing shows that some workloads experience double the storage performance while reducing CPU usage by over 70%. The system offloads AES-XTS-256 encryption processing from the main processor to a fixed-function cryptography engine embedded within the SoC. Encryption keys are hardware-wrapped to enhance security against memory-based attacks. The initial rollout will target Intel vPro platforms with the upcoming Core Ultra Series 3 "Panther Lake" processors, but Microsoft plans to extend support to other vendors as well.