Security
news

Faking a Yes: 6 Attacks on the Human Confirmation in a .NET 10 MCP Server

A developer red-teamed the confirmation step of a refund MCP server built on ASP.NET Core with the official C# SDK (ModelContextProtocol 2.3.0). Six attacks — plain-JSON requestState, replaying another user's approval, injected form fields and a pre-checked consent box — each led to a concrete server-side defense, plus a checklist you can apply to your own tools.

PHP2Shell and Azure DevOps: what Pipelines users should check

PHP disclosed two critical vulnerabilities on October 21, 2026 that can allow remote code execution. Azure DevOps Services and Server do not use PHP for customer requests, so the exposure sits in the PHP runtimes your pipelines, agents, containers and deployed apps use. The post explains which PHP installs Microsoft patches and which ones you must patch.

.NET October 2026 out-of-band security updates: Brotli and tarball ownership

Microsoft shipped out-of-band security updates for .NET 8, 9, 10 and .NET 11 RC3. CVE-2026-111497 fixes a Brotli decompression buffer overflow, and CVE-2026-114148 fixes unsafe ownership metadata in Linux tarballs. Two earlier fixes that the October 13 release missed were also re-shipped. Rebuilding self-contained apps and container images is required to pick up the fix.

Authorize is not enough: ownership checks against IDOR in ASP.NET Core

A developer found an IDOR flaw in their own security test, where an endpoint returned records without checking that they belonged to the caller. The article explains why [Authorize] alone cannot cover ownership and how to make the check hard to forget.

Agentic Copilot Autofix for code and dependency alerts in Azure DevOps

Copilot Autofix for GitHub Advanced Security in Azure DevOps now runs on an agentic foundation. It proposes fixes as pull requests for code scanning alerts from third-party tools and for dependency vulnerabilities. Your team still makes the final merge decision, so the fixes need to be reviewed like any other change.

Shrinking the ASP.NET Core auth cookie with ITicketStore

Cookie authentication in ASP.NET Core serializes the whole AuthenticationTicket into the cookie, so large claim sets can push it past WAF limits. Implementing ITicketStore keeps the ticket on the server and leaves only a session key in the cookie. The article compares an in-memory store with a distributed cache version and discusses the scaling and revocation trade-offs.

Using the ADFS userinfo endpoint instead of allatclaims

This post shows how to keep the ADFS ID token small and fetch extra claims from the OpenID Connect userinfo endpoint instead of using allatclaims. It covers the urn:microsoft:userinfo claim rules and the ASP.NET Core OpenIdConnect setting that merges those claims. It also flags the audience error that appears when the wrong token is sent.