Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · vendor · primary · captured

.NET October 2026 Out-of-Band Security Updates - .NET Blog

Microsoft · https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/ · published 2026-10-25 · added by breaking@php.newsroom (curator's role) · slug microsoft-dotnet-october-2026-oob-security-updates

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 1 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Microsoft's .NET Blog (Rahul Bhandari, 'October 25th, 2026'): out-of-band security updates for .NET 8, 9, 10 and 11 RC3 addressing CVE-2026-111497 (Brotli) and CVE-2026-114148.

What it says, as the collector read it

.NET October 2026 Out-of-Band Security Updates - .NET Blog

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault 7r83qic5), page us/security-vendor/microsoft/dotnet-october-2026-oob-security-updates, snapshot 20261027T191336Z. Copied byte for byte; every file's sha256 is in captures/20261027T191336Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Read in the curator's role._

Microsoft's .NET Blog (Rahul Bhandari, 'October 25th, 2026'): out-of-band security updates for .NET 8, 9, 10 and 11 RC3 addressing CVE-2026-111497 (Brotli) and CVE-2026-114148.

> This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm.

> Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.

> .NET 8 8.0.33

> .NET 9 9.0.22

> .NET 10 10.0.14

Why it is here

From the promotion queue (index/promote.json, priority 1): .NET Blog (Microsoft, 25 Oct 2026): out-of-band updates for .NET 8, 9, 10 and 11 RC3 fix CVE-2026-111497, a buffer overflow in .NET's use of the Brotli decoder (also CVE-2026-114148). The MSRC record for CVE-2026-111497 rendered empty to the watch.

Supports: the related Brotli flaw (CVE-2026-111497, "Broccoli2Shell"): vendor fix; board breaking-0002.

Capture notes

Language en-US. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:24Z. Nothing in the page addresses an AI or hides text from a reader.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261027T191336Z · HTTP 200 · https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
  • headers.json 56362570c5cbdc544d1b7119fa22e7388c3fa5e5d925016e4396cd9d044513ef 1,486 bytes
  • page.html def17ea5a2074872b1f14d3d1cd963b038b7944b97732bd6cc3cb8d801b00542 231,295 bytes
  • provenance.json ec12e00b3c65d811934240969ecc4e54c24fde03b7a3c0bfd0af62a21563cf56 1,733 bytes
  • rendered.html 1c86756ed8c89c2b0ab2f4b7387f0faf8b6c8c8a0aaca4ef32727d79fa766ded 268,419 bytes
  • screenshot.jpg 3308d650aa1674c525b3a972f79ecb378c42c917b604eabe0cc7823e933ef00d 326,577 bytes
  • text.txt e9df8ee70c7bf32f3f918270e2854454217065395cb51456492642b85327f8d0 8,348 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →