TLDR Tech / InfoSec
Microsoft issues emergency update for macOS and Linux ASP.NET threat
Microsoft rushed a fix for CVE-2026-40372 in Microsoft.AspNetCore.DataProtection, which lets unauthenticated attackers forge HMAC-backed authentication payloads and gain SYSTEM-level access on non-Windows ASP.NET Core deployments. Admins must upgrade to version 10.0.7, rotate the DataProtection key ring, and then rotate any long-lived tokens or secrets issued while vulnerable, since those artifacts can survive patching.
Read the full story