# .NET 8 Published articles for .NET 8. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## November 2026 Patch Tuesday forecast: Old software continues to bite DevFeed: [November 2026 Patch Tuesday forecast: Old software continues to bite]() Original publisher: [Read original article]() Author: Help Net Security Published: 2026-11-06T07:00:48Z Content type: news Language: en Sources: [Help Net Security]() Topics: [cve remediation](), [snyk-security-intel]() Tags: [2014](), [2026](), [cve](), [cve-2026-96951](), [cves](), [cybersecurity](), [don-t-miss](), [expert-analysis](), [forecast](), [hot-stuff](), [microsoft](), [net](), [net-11](), [net-8](), [net-framework](), [news](), [november-2026](), [october](), [october-2026](), [opinion](), [patch](), [patch-tuesday](), [predictions](), [security](), [software](), [update](), [zero-day]() ### AI overview The article's practical takeaway is to patch actively exploited flaws promptly and keep removing obsolete software: even final-patched or abandoned apps can remain network-connected and expose systems. PHP2Shell (CVE-2026-109618/109619) was exploited before patches appeared; applying the fix requires replacing the PHP runtime and restarting the web server, since old code otherwise stays in memory. Microsoft's emergency Brotli-related .NET fix covered .NET 8, 9, 10 and .NET 11 RC3; proof-of-concept code existed, but the article reported no known in-the-wild exploitation. Microsoft also removed seven compromised certificate entries from Windows trust and said preview fixes for VPN failures and Smart App Control would enter the November cumulative release. Apple's October updates addressed many CVEs, including a backported iOS/iPadOS fix for a CoreGraphics flaw reportedly exploited against targeted individuals. The November release expectations for Microsoft, Adobe, Google and Mozilla are forecasts, not confirmed releases. ### Source excerpt How did you enjoy October 2026 Patch Tuesday? Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week? They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs. As in previous months, there were limited CVEs we needed to immediately deal with. In October, one zero-day CVE-2026-96951 ... More -> The post November 2026 Patch Tuesday forecast: Old software continues to bite appeared first on Help Net Security. ## CVE-2026-63346 - Refitter: C# source injection through OpenAPI header parameter names DevFeed: [CVE-2026-63346 - Refitter: C# source injection through OpenAPI header parameter names]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-10-30T23:17:14Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [C#](), [OpenAPI Specification](), [client library]() Tags: [2026](), [api](), [application](), [assembly](), [behavior](), [c-sharp](), [class](), [client](), [code](), [cve](), [cve-2026-63346](), [header](), [interface](), [library](), [name](), [net](), [net-8](), [openapi](), [parameter](), [source]() ### AI overview Before Refitter 2.1.2, an OpenAPI header parameter name was inserted unescaped into a Refit `[Header("")]` attribute. An attacker-controlled description could therefore inject valid C# into generated code; a `[ModuleInitializer]` could run the injected code when the compiled assembly loads at startup, even if the API client is never called. The excerpt says default validation does not block this path and notes that query `AliasAs` and enum/default value sinks are escaped. The behavior was verified with Refitter 2.0.0 and .NET 8; the issue is fixed in 2.1.2. ### Source excerpt CVE ID :CVE-2026-63346 Published : Oct. 30, 2026, 11:17 p.m. | 39 minutes ago Description :Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Dev snapshot: Godot 4.8 beta 2 DevFeed: [Dev snapshot: Godot 4.8 beta 2]() Original publisher: [Read original article]() Author: Thaddeus Crews Published: 2026-10-29T12:00:00Z Content type: release Language: en Sources: [Godot Engine Official]() Topics: [Godot](), [project release](), [Open Source]() Tags: [2](), [about](), [all](), [also](), [android](), [animation](), [apply](), [asset](), [attention](), [backups](), [best](), [beta](), [blending](), [dev](), [godot](), [godot-4](), [net](), [net-10](), [net-8](), [pre-release](), [snapshot]() ### AI overview Godot 4.8 beta 2 is a feature-complete-stage prerelease focused largely on fixes: the team reports addressing nearly 150 regressions since beta 1, and 59 contributors submitted 144 fixes. Changes include correcting Compatibility rendering's multiply blending, improving XR viewport error messages, and fixes across animation, editor, GDScript, GUI, and imports. The standard build supports GDScript and GDExtension; the .NET build also supports C# and now requires .NET 10 or newer, up from .NET 8. The release is still prerelease software, so the post recommends frequent backups or version control and invites testers to check existing issues before reporting bugs. The excerpt covers changes since beta 1, not the full set of Godot 4.8 changes. ### Source excerpt 4.8's second beta snapshot arrives ## Microsoft Releases Out-of-Band .NET Security Updates: Four Vulnerabilities Addressed DevFeed: [Microsoft Releases Out-of-Band .NET Security Updates: Four Vulnerabilities Addressed]() Original publisher: [Read original article]() Author: PravinKarthik Published: 2026-10-26T17:22:12Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [.NET](), [Vulnerabilities](), [cve remediation](), [Security](), [ASP.NET](), [Linux]() Tags: [brotli](), [buffer](), [buffer-overflow](), [cve](), [cve-2026-111497](), [cve-2026-114148](), [dotnet](), [microsoft](), [net](), [net-10](), [net-11](), [net-8](), [net-9](), [october](), [oob-patches](), [out-of-band](), [releases](), [security](), [security-updates](), [updates](), [vulnerabilities](), [vulnerability]() ### AI overview Microsoft's October 25, 2026 out-of-band .NET updates address four vulnerabilities, including two fixes that correct issues left unresolved by the October 13 updates. The risks differ by component: Brotli decompression can expose applications processing untrusted compressed data; affected Linux tarball ownership metadata can enable local file modification and privilege escalation; and the corrected SocketAsyncEventArgs fix covers .NET 8-11, while the Blazor WebAssembly debugger issue affects .NET 10-11 and requires updating specific server and dev-server package references. Deploy the applicable patched release (8.0.33, 9.0.22, 10.0.14, or .NET 11 RC3), rebuild self-contained applications and containers, review affected Linux installations, and verify production versions. `dotnet --list-runtimes` checks shared runtimes but does not reveal runtimes bundled with self-contained or NativeAOT applications. .NET Framework is not affected by the described Brotli vulnerability. ### Source excerpt Microsoft Releases Out-of-Band .NET Security Updates: Four Vulnerabilities Addressed Microsoft released out-of-band security updates for .NET on October 25, 2026, outside its regular monthly servicing schedule.The release addresses a buffer overflow vulnerability in Brotli decompressi ... Read more Published Date: Oct 26, 2026 (2 hours, 22 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-111497 CVE-2026-70197 CVE-2026-102870 CVE-2026-114148 ## Microsoft releases emergency .NET patches for critical Brotli flaw DevFeed: [Microsoft releases emergency .NET patches for critical Brotli flaw]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-10-26T15:38:24Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [.NET](), [patches](), [Microsoft](), [ASP.NET Core]() Tags: [2026](), [broccoli2shell](), [brotli](), [computer-help](), [computers](), [critical](), [critical-vulnerability](), [emergency](), [emergency-update](), [http2shell](), [linux](), [mac](), [malware](), [malware-removal](), [microsoft](), [net](), [net-10](), [net-11](), [net-8](), [net-9](), [node2shell](), [out-of-band](), [patch](), [patches](), [releases](), [security](), [security-update](), [security-updates](), [spyware](), [support](), [tech-support](), [technical-support](), [updates](), [virus](), [virus-removal](), [vulnerability](), [windows]() ### AI overview Microsoft issued out-of-band security updates for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 to fix CVE-2026-111497, a critical out-of-bounds write in Brotli decompression also called Broccoli2Shell, Node2Shell, and HTTP2Shell. A malicious compressed stream can cause crashes or memory leaks and may enable remote code execution; the advisory also describes remote privilege escalation on unpatched .NET systems using non-default configurations. Applications are exposed when they opt into ASP.NET Core request decompression or HttpClient automatic response decompression, or invoke .NET Brotli APIs; decompression is not enabled by default. PoC exploits are public, but the excerpt reports no malicious exploitation in the wild. Microsoft advises updating promptly. If patching is delayed, block incoming Brotli-compressed requests through a proxy or firewall, or disable Brotli decoding. Updating the system Brotli library may not protect applications that bundle their own copy. ### Source excerpt Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...] ## .NET October 2026 Out-of-Band Security Updates DevFeed: [.NET October 2026 Out-of-Band Security Updates]() Original publisher: [Read original article]() Author: Rahul Bhandari (MSFT) Published: 2026-10-25T18:45:00Z Content type: release Language: en Sources: [.NET Blog]() Topics: [.NET](), [Security](), [ASP.NET Core]() Tags: [2026](), [algorithm](), [apis](), [application](), [applications](), [artifacts](), [brotli](), [cve-2026-111497](), [cve-2026-114148](), [maintenance-updates](), [net](), [net-10](), [net-11](), [net-8](), [net-9](), [net-framework](), [october](), [oob](), [out-of-band](), [ownership](), [security](), [security-updates](), [updates](), [vulnerability]() ### AI overview The October 2026 out-of-band updates for .NET 8, 9, and 10 and .NET 11 RC3 address Brotli decoder vulnerability CVE-2026-111497 and Linux tarball ownership vulnerability CVE-2026-114148, and provide fixes for two issues not fully addressed by the October 13 release. Brotli processing may be affected through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression APIs; the two decompression features are off by default, and .NET Framework is unaffected. The tarball issue affects source-build tarballs for .NET 10 and 11, and also ASP.NET Core tarball distributions for .NET 8 and 9. To update, install the targeted runtime and restart framework-dependent apps; rebuild and republish self-contained apps; rebuild and redeploy containers with updated images; or use updated source-build artifacts and rebuild packages. ASP.NET Core tarball users on .NET 8 and 9 should install the refreshed tarball. .NET 11 RC2 users should move to RC3. ### Source excerpt Out-of-band security updates for .NET address the Brotli decoder vulnerability and tarball ownership vulnerability. The post .NET October 2026 Out-of-Band Security Updates appeared first on .NET Blog.