Admins who installed Microsoft’s Oct. 13 .NET security update have one more to apply. On Sunday, less than two weeks after that regular release, Microsoft shipped an out-of-band round of .NET 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3 , and Rahul Bhandari, a senior program manager on the .NET team, recommended updating as soon as possible.

Part of the reason is unfinished business. The October update didn’t fully address CVE-2026-70197, a SocketAsyncEventArgs memory corruption bug, or CVE-2026-102870 in the Blazor WebAssembly debugger, so Microsoft re-released both advisories with the new builds carrying the complete fixes. The .NET 10 support note lists the Blazor bug as remote code execution and says this build corrects BrowserDebugHost packaging for that fix.…