Microsoft released out-of-band security updates for .NET 8, 9, and 10, plus .NET 11 Release Candidate 3, and recommends installing them promptly. The main fix addresses CVE-2026-111497, a buffer overflow in Brotli decompression that could let an unauthenticated attacker read or corrupt process memory, potentially causing information disclosure, denial of service, or privilege escalation. It affects all platforms when applications process Brotli-compressed data through relevant APIs or decompression features; ASP.NET Core request decompression and HttpClient automatic response decompression are off by default. .NET Framework is not affected. The updates also fix CVE-2026-114148, involving unsafe ownership metadata in Linux .NET tarballs that could permit local privilege escalation.
The release also completes fixes for CVE-2026-70197, involving SocketAsyncEventArgs memory corruption, and CVE-2026-102870, affecting the Blazor WebAssembly debugger; earlier October updates did not fully address these issues. The updated releases are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3. The tarball issue affects source-build packages for .NET 10 and 11, and additionally ASP.NET Core tarballs for .NET 8 and 9. Framework-dependent apps need the updated runtime installed and restarted; self-contained apps and containers must be rebuilt and redeployed. Source-build users and affected ASP.NET Core tarball users must obtain refreshed artifacts.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Canada’s proposed Bill C-22 would let officials compel digital services to assist surveillance and create law-enforcement access, raising concerns about security and privacy. Signal, NordVPN, Windscribe, and other companies say they could limit services or leave Canada if the bill passes. (btxx.org)
Chinese research vessels spent more time near Pacific undersea cables than vessels from any other country, according to an analysis of 200 ships. Their “lawnmower” survey patterns could map the seafloor for military operations or potential sabotage. (tomshardware.com)
A cross-request KV cache flaw in Cloudflare’s GLM-5.3 Workers AI model exposed data between requests. Cloudflare describes how it remediated the issue, which involved 155 responses. (blog.cloudflare.com)
ColdFusion servers can have PHP installed and running alongside ColdFusion, sometimes without administrators realizing it. The guide explains how to check for PHP and remove it if it is not needed. (gregoryalexander.com)
Rhode Island has sued Meta, alleging the company profited from scam ads on its platforms. The state is the first to bring this type of lawsuit against Meta. (rhodeislandcurrent.com)
Russian IT specialist Yuri Belenko was sentenced to 13 years for donating to a Ukrainian military fund. Investigators used customer data Binance provided in response to a Russian Investigative Committee request to prove the transfers. (meduza.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.