CVE-2026-111760 lets a malicious repository plant hooks through a submodule during a recursive clone. Fixes are backported to every release line from 2.50, and tools that bundle Git need updating too.
.NET 8 and .NET 9 lose support as Microsoft ships .NET 11
EditorialBy TrustList Editorial
Versions 8.0.34 and 9.0.23 are the last patches either will get. .NET 10 is the long-term release to move to, and both it and the new .NET 11 are supported until 14 November 2028.
- Software Development
- Application Security
- Patch Management
- DevOps
About .NET 8 and .NET 9 lose support as Microsoft ships .NET 11
.NET 8 and .NET 9 lose support as Microsoft ships .NET 11
10 November 2026: Microsoft's .NET 8 and .NET 9 have reached the end of support on the day .NET 11 was released. Versions 8.0.34 and 9.0.23, published alongside it, are the last patches either line will receive, so any flaw found from now on in those runtimes stays unfixed.
Two lines end on the same day
The two versions arrived a year apart but leave together. .NET 8, released on 14 November 2023, was a long-term support release with three years of fixes. .NET 9, released on 12 November 2024, was a standard-term release whose support ended on the same date. Microsoft's support table now lists both under out-of-support versions.
The practical effect lands on applications, not just developer machines: web services, background workers and desktop apps built on either version, and container images that bundle the runtime, stop getting security fixes. Microsoft shipped an out-of-band security release for 8.0, 9.0 and 10.0 only weeks ago, which shows how often those fixes come.
Where to move
| Version | Type | Released | Support ends |
|---|---|---|---|
| .NET 11 | Standard term | 10 November 2026 | 14 November 2028 |
| .NET 10 | Long term | 11 November 2025 | 14 November 2028 |
| .NET 9 | Standard term | 12 November 2024 | Ended 10 November 2026 |
| .NET 8 | Long term | 14 November 2023 | Ended 10 November 2026 |
.NET 10, the current long-term release, had its own patch, 10.0.15, on 10 November. Microsoft's announcement says .NET 10 remains the supported long-term option, which makes it the conservative target for teams leaving .NET 8. The new .NET 11 has the same end date, 14 November 2028, because the standard-term period is now two years.
What .NET 11 adds
Microsoft's release post names union types and closed hierarchies in C
15, a Native AOT host for the command-line tooling, and OpenAPI 3.2 support in ASP.NET Core. .NET Conf runs from 10 to 13 November with the release sessions.
For teams still on .NET 8, the jump to .NET 10 is two major versions, which usually means checking breaking-change lists for both 9 and 10 rather than one. Teams that bought .NET applications from a vendor should ask which runtime the product ships on and when the vendor's own move is scheduled, since an unsupported runtime inside a supported product is still unpatched.
Sources
Categories & features
- Software Development
- Application Security
- Patch Management
- DevOps
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
"Yes, and don't ask again" saves the full approved command, keys included, into a project file that is often committed. 5,343 of the secrets still worked when found.
One lets a user who can view users or audit events become an administrator, and turns critical where guest access is on. Patches shipped in September; Octopus Cloud is already fixed.
Seven are rated high, including an account takeover through OAuth2 auto-linking and fork workflows that receive repository secrets. Every release up to 28.2.0 is affected; there is no backport line.
Every musl release from 0.5.0 to 1.2.6 is affected. The maintainers ship a patch now and say 1.2.7 will follow; only programs that compile regular expressions from untrusted input are exposed.
The expedited releases distrust the compromised eMudhra intermediates inside the ssl module, so pip is safe even before it is updated. A tarfile filter bypass and a cookie parsing bug are fixed too.
Besides the bundled OpenJPEG overflow, the Python imaging library published 39 more advisories fixed in 13.0.0, including code execution from one crafted FlashPix file. One Arrow memory leak is still unfixed.
CVE-2026-111497 is rated 9.2 by Google and hits every Brotli release from 1.0.3 to 1.2.0. Envoy, the PyPI packages and Debian have shipped fixes; Ubuntu still ranks it medium.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More Software DevelopmentThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.