CVE-2026-40372: The Data Protection HMAC Bug That Made Cookie Forgery Trivial on Linux
Microsoft's emergency .NET 10.0.7 out-of-band update patches a CVSS 9.1 flaw in the Data Protection managed encryptor. If you run ASP.NET Core on Linux, your HMAC validation was effectively broken since .NET 10 shipped.
.NET April 2026 Security Patches: SMTP Header Injection and XML Recursion Bombs Explained
Microsoft's April 2026 servicing update patches two high-severity vulnerabilities in System.Net.Mail and System.Security.Cryptography.Xml. Here is how they work, why they matter, and what you need to do.
Post-Quantum Cryptography in .NET 10: ML-KEM, ML-DSA, and SLH-DSA from System.Security.Cryptography
With .NET 10 shipping built-in support for three NIST-standardised post-quantum algorithms, here is how ML-KEM, ML-DSA, and SLH-DSA work in practice, what the APIs look like, and what you need to watch out for on different platforms.
Cryptography in .NET: Hashing, Encryption, and Getting It Right
A practical guide to hashing passwords, encrypting data, and using .NET's cryptography APIs without the common pitfalls.