It's that time of the season again, time for BsidesLondon! Let me know if you're around!

We’re headed to Toronto! 🇨🇦 We’re excited to partner up with @cppnorth.bsky.social for an incredible 4-day event you don’t want to miss. We’re currently booking speakers, and the CFP is open → ndctoronto.com

Generating SBOMs for .NET apps and NuGet packages with Microsoft.Sbom.Targets

I recently did a talk on internet safety for parents/guardians and it was well received by those in the room. Its honestly the toughest talk I have researched and given. It might help you if you have kids or you are the local tech support for people with small humans. www.youtube.com/watch?v=UgF5...

The call for papers for NDC Security ends tomorrow. Come do your talk in Oslo: ndcsecurity.com/call-for-pap...

I think this is not the type of “tampering” Matt Blaze was concerned with

If you missed Aleksander Stensby's 2-day workshop on MCP and RAG at NDC AI last week, don’t worry - you can still join the online workshop on 1–2 December! event.checkin.no/206017/ndc-o...

The details of .NET's PQ algorithms, and their APIs are available devblogs.microsoft.com/dotnet/post-...

🎤 Meet one of our VISUG XL 2025 speakers: 𝐍𝐢𝐞𝐥𝐬 𝐓𝐚𝐧𝐢𝐬! We’re excited to welcome 𝐍𝐢𝐞𝐥𝐬 this year at Visug XL, our yearly, free, community-driven .NET conference. 📅 November 28, 2025 📍 UCLL Leuven 👉 More information and tickets: www.visug.be/Events/102 #VisugXL #DotNet #Community #Conference

With 80% of modern #apps built on third-party #code, supply chain #security has become critical. Don't miss @niels.fennec.dev "Beyond Trust: Building Community-Driven Security Analysis for Your .NET Software Supply Chain" at #NDCManchester! ndcmanchester.com/agenda/beyon...

Chatbots — LLMs — do not know facts and are not designed to be able to accurately answer factual questions. They are designed to find and mimic patterns of words, probabilistically. When they’re “right” it’s because correct things are often written down, so those patterns are frequent. That’s all.

We are increasing the length of support offered for .NET Standard Term Support (STS) releases from 18 months to 24 months. This change is effective starting with .NET 9 and there is no change for LTS releases. Get all the details you need: msft.it/63328t6MeM

Microsoft is expanding transparency in vulnerability management. We are now publishing VEX (Vulnerability Exploitability eXchange) attestations for third-party CVEs associated with the Azure Linux Distribution (formerly CBL-Mariner). Learn why VEX matters in our blog post: msft.it/6014shEmn

"A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called #GlassWorm that has been installed an estimated 35,800 times." #CyberSecurity #VSCode #SupplyChainAttack www.bleepingcomputer.com/news/securit...

"Researchers [...] said today that it takes only 250 specially crafted documents to force a generative AI model to spit out gibberish when presented with a certain trigger phrase." #AI #LLM #GenAI #ModelPoisoning #AISecurity #CyberSecurity www.theregister.com/2025/10/09/i...

It's Patch Tuesday and ASP.NET Core has a doozy, with a CVSS score of 9.9, our highest ever. Let's examine why. The bug enables http request smuggling, which on its own for ASP.NET Core would be nowhere near that high, but that's not how we rate things... * Thread- (1/7)

And while we're talking about .NET security we have another announcement. Do you build and distribute your own version of .NET? Then you wanted to get early access to upcoming patch information sooner to protect your customers at the same time as we release patches.

⏳ #𝐕𝐢𝐬𝐮𝐠𝐗𝐋 𝟐𝟎𝟐𝟓 is approaching! We’re gearing up for our annual 𝐜𝐨𝐦𝐦𝐮𝐧𝐢𝐭𝐲-𝐝𝐫𝐢𝐯𝐞𝐧 .𝐍𝐄𝐓 𝐜𝐨𝐧𝐟𝐞𝐫𝐞𝐧𝐜𝐞! 💜 The 𝐚𝐠𝐞𝐧𝐝𝐚 𝐢𝐬 𝐚𝐥𝐦𝐨𝐬𝐭 𝐫𝐞𝐚𝐝𝐲, and we can’t wait to share the amazing lineup with you soon! 📅 𝐍𝐨𝐯𝐞𝐦𝐛𝐞𝐫 𝟐𝟖, 𝟐𝟎𝟐𝟓 — 𝐔𝐂𝐋𝐋 𝐋𝐞𝐮𝐯𝐞𝐧 🎟️ Get your 𝐭𝐢𝐜𝐤𝐞𝐭𝐬 here 👉 www.visug.be/Events/102

Was this DEFCON eBPF bug talk hallucinated? www.thestack.technology/defcon-ebpf-...

For the SecurityConversations show, I interviewed appsec and software supply chain security expert Chris Eng @ceng.bsky.social LISTEN securityconversations.com/episode/chri...

"We want AI agents that can discover like we can, not which contain what we have discovered. Building in our discoveries only makes it harder to see how the discovering process can be done." - The Bitter Lesson (2019), by Rich Sutton www.incompleteideas.net/IncIdeas/Bit...

I'm hiring! Looking for an #aspnetcore dev, ideally with identity/oidc experience. Role is support, tech presales, advisory, docs, ... East coast US ideally for timezone overlap in the team Small team and company, big ambition. Reach out if you're interested! duendesoftware.com/careers/cust...

Alternative MFA...

.NET STS releases are now supported for 2 years instead of 18 months starting with .NET 9 (the current STS). STS releases now go out-of-support on the same day as the previous LTS release. Upgrading to an STS release will no longer cause you to lose support! devblogs.microsoft.com/dotnet/dotne...

The WebAssembly 3.0 spec is complete! webassembly.org/news/2025-09... This includes major features like GC, 64-bit memories, exceptions, and tail calls.

CVE-2025-9708: Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks -

nuget trusted publishing from GitHub actions is rolling out. No more api keys needed to publish from your release process. learn.microsoft.com/en-us/nuget/...

Don't miss out on all the new stuff in C# with ⁨@fekberg.bsky.social at NDC Copenhagen next week 🇩🇰 See the full agenda and get your tickets at ndccopenhagen.com

Some notes on the insecurity baked into Perplexity's Comet "AI Browser" - the Brave security team reported serious prompt injection vulnerabilities in it, but Brave themselves are developing a similar feature that looks doomed to have similar problems simonwillison.net/2025/Aug/25/...

Come get your post quantum algorithms. And key wrapping.

Excited to share what my team and I have been working on for the past year 🎉 The new Dependabot NuGet updater is here to help keep your .NET dependencies secure and up-to-date. Check out all the details in our blog post devblogs.microsoft.com/dotnet/the-n...

The S in MCP stands for security

I wrote up some things I learned about vulnerabilities in .NET Base Class Libraries (BCL) #dotnet #security #appsec #cve #blog jamiemagee.co.uk/blog/underst...

It's awesome to be Microsoft MVP for another year! I really enjoy sharing knowledge and interacting with the community and of course will continue to do that! Congratulations to fellow MVP's that got renewed as well! #mvpbuzz #appsec #security

If you use "AI agents" (LLMs calling tools in a loop) you need to be aware of the Lethal Trifecta Combine access to private data, exposure to untrusted content and the ability to externally communicate and an attacker can trick the system into stealing your data simonwillison.net/2025/Jun/16/...

Patch Tuesday saw an update to the .NET runtime to fix a DLL planting vulnerability. github.com/dotnet/annou...

Prompt Injection is a top risk for use of LLMs, where untrusted data can cause a system to misbehave or leak data. We're hard at work on deterministic solutions to prevent or bound the risk, and just published a paper on our innovative information flow control approach: arxiv.org/pdf/2505.23643

Researchers from Rice and Stanford refer to this recursive data contamination as Model Autophagy Disorder (MAD), analogous to mad cow disease. (Reminder: do not eat the neural tissue of your own species.) therepublicjournal.com/essays/the-c...

so good! fly.io/blog/youre-a...

The time has finally come to kick off SecAppDev 2025. Packed room, great program, and even some sunshine. All the ingredients for an immersive week of learning about application security. #appsec #infosec

And now it's time to listen to Tom van den Berg at NDC Oslo talking about the need for securing our .NET software supply-chain! @ndcconferences.com

Enjoying a fantastic talk from @niels.fennec.dev about LLM security at #ndcoslo

Almost time to hit the road to Oslo for NDC Conferences Oslo! If you're there as well make sure to attend my session on Thursday, 15:00 in Room 5 (ndcoslo.com/agenda/using...) #mvpbuzz #appsec #genai

💥NDC Oslo kicks off in less than 3 weeks! Don't miss out keynote speaker @noctovis.bsky.social and 150 other amazing speakers. See the full agenda and secure your tickets at ndcoslo.com.

Little Bobby Tables... the next generation.

MCP is the protocol de jour, so we wrote up a blog on some of the security risks to be aware of and mitigating controls you can put in place if you want to implement it. techcommunity.microsoft.com/blog/microso...

GenAI is revolutionizing software dev—but at what cost to security? 40% of GenAI created code has vulns. Devs think it's secure. It’s not. My latest: how to balance velocity + security in the GenAI era. www.forbes.com/councils/for...

We have some thoughts block.github.io/goose/blog/2...

Look what just got merged 🎉🥂🧙‍♂️🎉 github.com/NuGet/Home/p...

We are so excited to announce the next batch of speakers for SecAppDev. This line-up is a great start to maybe our best program yet! The website also contains info on two hands-on workshops, and two more will be announced soon. Hope to see you at SecAppDev 2025! #appsec #infosec