Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
Stories per day · 30 days
2 RSS
Relatedbrotli11microsoft7buffer-overflow5nodejs4kev3remote-code-execution3cve-2026-969512envoy2out-of-bounds-write2patch-tuesday2ubuntu2windows2zero-day2aspnet1aspnet-core1blazor1broccoli2shell1cisa1
19 stories, newest first · one card per story
Stories tagged #dotnet
XWorm loader reused in phishing against Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
Microsoft ships emergency .NET patches for critical Brotli flaw
CVE-2026-111497 is an out-of-bounds write; public proof-of-concept exploits exist, with no reported in-the-wild attacks.
Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
Microsoft issues emergency .NET fixes for four vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.
Ubuntu ships .NET security updates in USN-8942-1
.NET 8, 10, and 11 move to 8.0.32, 10.0.13, and 11.0.0~rc2 on the listed Ubuntu releases.
Microsoft Patches More Than 1,400 Security Flaws
Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.
6
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.
11
Attackers Hid Behind Trusted RMM Software Before Deploying a Full Surveillance RAT
Attackers abuse signed RMM tools via fake Microsoft Store pages to deploy new .NET spyware RAT AgtaBackup with keylogging and browser data theft.
2
USN-8740-1: .NET vulnerabilities
Ubuntu issued USN-8740-1 fixing two .NET watch flaws, CVE-2026-58649 and CVE-2026-69806, enabling information exposure and privilege escalation.
The hidden work of modernizing Malwarebytes
Malwarebytes details its migration of Windows product managed components to .NET 10, citing security, supportability, diagnostics, and performance benefits.
4
Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 2
Canada's Cyber Centre updated advisory AV26-804 relaying Microsoft's August 2026 monthly rollup of vulnerabilities across .NET and Azure products.