.NET 11 security changes target the software supply chain
Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support, and the release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development.
Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support, and the release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development.
Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle.
NuGet source configuration has a new minimum package publication age setting; teams can use it to wait a set time before newly published package versions can be selected.
Microsoft advises organizations to move to .NET 11, or to .NET 10 if they need a longer support lifecycle; in System.IO.Compression, reading ZIP entries now includes CRC32 validation, and Zstandard compression is newly supported.
In effect, this works as a cooldown period, which can help defend against malicious or compromised package releases that would otherwise get pulled into builds.
Container publishing now produces reproducible image digests through SOURCE_DATE_EPOCH, so teams can check that an image matches what a given source should produce.
Microsoft notes that it adds to vulnerability checks and dependency review but doesn’t replace them; this helps long-lived connections that might otherwise run on stale credentials.
Asynchronous validation lets validators await database lookups or remote calls without blocking threads.
.NET 8 and .NET 9 reached end of support on November 10, 2026, the same day .NET 11 shipped, and they will get no more fixes, and teams running release candidates of .NET 11 are told to move to the final build.
Blazor Interactive Server components receive the updated identity and can react when claims change; it was previously available on mobile platforms and now also works on Linux and macOS, which could help with incident investigation.
What happened
Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support, and the release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development.
Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle.
What changed
NuGet source configuration has a new minimum package publication age setting; teams can use it to wait a set time before newly published package versions can be selected.
Who is affected
Microsoft advises organizations to move to .NET 11, or to .NET 10 if they need a longer support lifecycle; in System.IO.Compression, reading ZIP entries now includes CRC32 validation, and Zstandard compression is newly supported.
Why it matters
In effect, this works as a cooldown period, which can help defend against malicious or compromised package releases that would otherwise get pulled into builds.
Container publishing now produces reproducible image digests through SOURCE_DATE_EPOCH, so teams can check that an image matches what a given source should produce.
Technical details
Microsoft notes that it adds to vulnerability checks and dependency review but doesn’t replace them; this helps long-lived connections that might otherwise run on stale credentials.
Asynchronous validation lets validators await database lookups or remote calls without blocking threads.
Response
.NET 8 and .NET 9 reached end of support on November 10, 2026, the same day .NET 11 shipped, and they will get no more fixes, and teams running release candidates of .NET 11 are told to move to the final build.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.