UK — The Register

Microsoft releases emergency .NET security fixes for Google Brotli bug

SecurityOctober 27, 20261 min read

Microsoft has released emergency security updates for .NET, its software framework for building apps. The fixes patch a serious bug in Google's Brotli compression tool that could let attackers corrupt computer memory.

What happened

Microsoft released an out-of-band update, which means an update sent outside its normal schedule. It covers .NET 8, 9, 10, and 11. Microsoft urges users to install it as soon as possible. The bug is a buffer overflow in Brotli, a tool that shrinks data so it moves faster across the internet. Other projects, including Node.js and Python, have released similar fixes.

Key facts

The bug is tracked as CVE-2026-111497.
Microsoft rates it 8.1 out of 10 under CVSS v3.1, a severity score.
Microsoft's advisory says exploitation is "More Likely."
Microsoft says there is no sign that criminals are using it in real attacks yet.
Wiz says 91 percent of cloud environments use parts that are affected by the Brotli flaw.

How the bug was found

The bug was first made public on October 21 by the Node.js team, which fixed ten vulnerabilities. The root bug was fixed in Brotli's source code in February, but nobody knew then that it was a security problem. Because Brotli is built into many other programs, each one must also install the update.

Why it matters

Brotli is used in many apps and cloud services, so one flaw can reach many systems. An attacker can try to exploit it by sending specially crafted compressed data in a request. Researchers have also built a working exploit that affects FFmpeg, a video tool, which shows the risk goes beyond web requests.

What to watch

Whether attackers start using the public exploits in real attacks.
More software makers releasing updates that include the Brotli fix.
Whether companies install the .NET update quickly across their systems.

Glossary

.NET: A software framework from Microsoft that developers use to build apps and services.
Brotli: A compression tool from Google that makes data smaller so it can be sent faster.
buffer overflow: A bug where a program writes more data than a memory space can hold, which can let attackers cause harm.
CVE: A standard public ID number given to a known security flaw, like a name tag for the bug.
Node.js: A tool that lets developers run JavaScript code on servers, outside of a web browser.
FFmpeg: A free tool for handling video and audio files, used in many apps.

Customers to Sue Times Car Operator Over Data Leak, Lawyer Announces at Press Conference

Attorney Yuki Makino, who set up a class-action website, announced at a Tokyo press conference on October 26, 2026 that he will file a lawsuit at the Tokyo District Court against Park24, which operates Times Car, and its executives, seeking 30,000 to 50,000 yen per victim in damages. The suit follows a leak of up to about 6.6 million members' personal information, including driver's license images, after unauthorized access detected on September 25; more than 100,000 people have registered on the site.

SecurityITmediaOct 26

Joshin Unauthorized Access May Have Leaked Up to 6.23 Million Records, Including 2 Driver's Licenses and 1 My Number Card

Joshin, the Japanese electronics retailer that also runs a housing renovation business, said on October 26 that up to about 6.23 million member records may have leaked after unauthorized access to its network, which it had announced on the 17th. The data may include names, addresses, driver's license images, My Number Card information, and login details, and the company said the scope and whether any leak actually occurred are still under investigation. Joshin said it has no credit card information stored and warned users to be alert to suspicious emails, SMS messages, and calls impersonating the company.

Security전자신문Oct 26

Cyber Intrusions Spread to Insurers, Software and Travel Sectors as Financial Sector Breaches Mount

Mirae Asset Life Insurance reported a suspected personal data leak after detecting abnormal activity and notifying the Financial Supervisory Service, marking the insurance sector's first reported intrusion. Separate breaches hit enterprise software firm Douzone Bizon, which is investigating a possible leak of external partner and client employee data tied to a suspected zero-day flaw in backup software, and travel platform NOL, which confirmed leaked data from domestic accommodation booking customers. KB Kookmin Bank said the number of affected people in its earlier breach rose to 2,210 after 2,091 more were identified.