Microsoft releases emergency.NET patches for critical Brotli flaw

Neowin and BleepingComputer report that Microsoft released out-of-band updates for.NET 8, 9 and 10, alongside.NET 11 Release Candidate 3. The patches address a critical flaw in Brotli decompression; Neowin also reports a Linux-only tarball ownership flaw that could let a local attacker modify files and gain elevated privileges. BleepingComputer says proof-of-concept exploits for the Brotli flaw were public, but no malicious exploitation had been reported as of October 26, 2026.