Duende's Halloween-themed walkthrough explains DPoP, the RFC 9449 extension that binds access tokens to a client's key pair. Binding stops a stolen bearer token from being replayed against an API. The post follows the token request, the cnf.jkt claim and the proof check on the API side, and it maps each step to Duende's .NET libraries.
Obfuscation turns into a release-engineering problem once you must rebuild, verify, or debug what shipped. The article proposes three contracts for Opaquer-protected releases: identity, integrity, and diagnostics. It gives .NET teams a practical checklist for keeping protected builds traceable and readable in production.
Microsoft shipped out-of-band security updates for .NET 8, 9, 10 and .NET 11 RC3. CVE-2026-111497 fixes a Brotli decompression buffer overflow, and CVE-2026-114148 fixes unsafe ownership metadata in Linux tarballs. Two earlier fixes that the October 13 release missed were also re-shipped. Rebuilding self-contained apps and container images is required to pick up the fix.
The article examines what a .NET AI agent does when its own guardrails fail, such as a throwing guard, a down classifier, a missing caller or miswired middleware. The author deliberately breaks each guard layer and shows how to make the request blocked instead of silently allowed. It ends with a practical checklist for developers building guarded agents.
ASP.NET Core validates a JWT by its signature and expiry, so a stolen token keeps working after a password change. The article walks through two fixes: short-lived access tokens paired with revocable refresh tokens, then a token_version check for immediate revocation. Every .NET developer running JWT-based APIs should know where the gap is and what each fix costs.
A developer found an IDOR flaw in their own security test, where an endpoint returned records without checking that they belonged to the caller. The article explains why [Authorize] alone cannot cover ownership and how to make the check hard to forget.
Avalonia reported that unauthorised access during the 22-23 October 2026 attack was limited to its marketing website CMS. The entry point was an administrator token accidentally embedded in browser-delivered JavaScript. All 39 attempts to publish to its NuGet feeds were rejected, and customers need not reset passwords or replace licence keys.
A developer who has maintained ASP.NET Core APIs for years lists six recurring problems: scattered try/catch blocks, unbounded list queries, ignored cancellation tokens, lost UTC kinds, late config failures and unprotected login endpoints. Each comes with a suggested pattern using .NET 10 and EF Core 10, noted to work on .NET 8 with small changes.
The September 2026 update to GitHub Copilot in Visual Studio adds pull request exploration through the Git agent, moves Bring Your Own Model to a new Agent (Preview) mode, and lets Copilot fix vulnerable NuGet packages from the Error List. The BYOM change is breaking, so check your model setup before updating.
SharePoint Embedded guidance for moving apps to production has been updated. It covers container and tenant limits, handling throttling, narrower Graph permissions and Office co-authoring. For developers building on the Microsoft 365 platform, it offers concrete planning and security points.
AuthEndpoints 4 is a library that adds ready-made authentication endpoints on top of ASP.NET Core Identity. A single AddPasswordAuth and MapPasswordAuth pair covers sign-up, sign-in, 2FA, passkeys and password recovery. It targets .NET 10 and is compared with the built-in MapIdentityApi.
Amp now lets you run its orbs, the remote machines where coding agents do their work, on your own infrastructure. The amp orb provider command relays spawn, pause, and delete requests from Amp to a dispatch program you write. Teams that want agents on their own servers should note the setup model and the October 29 pricing change.