C#: security advisories, deprecations and releases

.NET October 2026 Out-of-Band Security Updates

OOB updates for .NET 8-11 fix Brotli buffer overflow (CVE-2026-111497) and tarball ownership issues (CVE-2026-114148), plus two earlier CVEs. All platforms affected.

CVE-2026-102870 CVE-2026-111497 CVE-2026-114148 CVE-2026-70197

Google Cloud App Engine flexible .NET security update

App Engine flexible environment updates .NET 6, 8, 10 and OS packages on google-22/24 stacks to fix security issues.

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

.NET and .NET Framework October 2026 servicing releases

Monthly security and non-security updates for .NET 10.0, 9.0, 8.0 and .NET Framework.

Microsoft updates NuGet author-signing certificate Sept 2026

Microsoft will replace its NuGet signing certificate on 2026-09-23. Existing packages keep their signatures; new packages will use the new certificate. Policies that pin the old fingerprint will block installation.

.NET Framework 4.6.2 reaches end of life on 2027-01-12

.NET Framework 4.6.2 reaches end of life on 2027-01-12, as listed by endoflife.date.

.NET 8 reaches end of life on 2026-11-10

.NET 8 reaches end of life on 2026-11-10, as listed by endoflife.date.

.NET 9 reaches end of life on 2026-11-10

.NET 9 reaches end of life on 2026-11-10, as listed by endoflife.date.

Retirement: Support for .NET 8 and .NET 9 ends on November 10, 2026

Microsoft will end support for .NET 8 and .NET 9 on November 10, 2026, leaving Azure Functions without security updates after that date.

.NET Framework 4.6.2 reaches end of life on 2027-01-12

.NET Framework 4.6.2 reaches end of life on 2027-01-12, as listed by endoflife.date.

.NET 9 reaches end of life on 2026-11-10

.NET 9 reaches end of life on 2026-11-10, as listed by endoflife.date.

.NET 8 reaches end of life on 2026-11-10

.NET 8 reaches end of life on 2026-11-10, as listed by endoflife.date.

AWS Transform GA: Azure-to-AWS .NET code conversion

AWS Transform now generally available for converting Azure SDK calls in .NET apps to AWS SDK equivalents, including Azure Functions to Lambda and Cosmos DB to DynamoDB.

Announcing .NET 11 Release Candidate 2

Second release candidate of .NET 11 is available with go-live support for production use, Visual Studio 2026 Insiders integration, and numerous improvements across libraries, runtime, SDK, F#, ASP.NET Core, MAUI, and Windows Forms.

AG-UI Protocol now has a first-class .NET SDK

Microsoft released a .NET SDK for the AG-UI protocol that lets any .NET service speak AG-UI directly, published on NuGet under MIT license.

Bring Your Own Model to the GitHub Copilot SDK with C#

Shows how to route GitHub Copilot SDK inference to Microsoft Foundry, Azure OpenAI, or any OpenAI-compatible endpoint using ProviderConfig.

Introducing dotnetup: A toolchain manager for .NET

dotnetup is a new non-admin .NET SDK and runtime manager for macOS and Linux modeled after rustup and nvm, supporting side-by-side installs, channel tracking, preview builds, and global.json integration.

Creating a memory dump in C#

Article shows how to detect thread-pool saturation in a .NET app and automatically capture a full memory dump on Windows or Linux for later debugging in Visual Studio.