Skip to content
ERP LEADERS
Subscribe to the brief Follow on LinkedIn

The news behind the software that runs companies, explained for everyone.

Security

Microsoft rushed out a .NET security fix on Sunday. Google's Brotli code was patched in February, but no one saw the danger.

Microsoft urged users of .NET, its platform for business applications, to update "as soon as possible," The Register reported.

ERP LEADERS news desk · · First reported by The Register · Edition no. 50
Photo: Wikimedia Commons, Public domain · original

The flaw sits in Brotli, Google's compression code used in web servers and apps. An attacker without a login could read or damage a program's memory.

Microsoft says experts have built working exploits, but nothing suggests anyone is using them in real attacks. Its advisory still rates exploitation "more likely."

Two researchers from the Codex Security team at OpenAI found the flaw. OpenAI said the root cause was fixed in Brotli's source code in February, "but it wasn't known at the time that it gave rise to a security vulnerability."

Node.js released fixes on 21 October. Python and other projects have also issued updates. Merav Bar of the security firm Wiz said 91% of cloud environments rely on software components vulnerable to the flaw.

No new Brotli release followed the February fix, OpenAI said. So the software that carries Brotli inside it, .NET included, needs its own update.

Sources

Spotted an error? Tell us. Every correction is logged on Standards.

Your reading room

Companies in this story
MicrosoftOpenAI

Our file on Microsoft

  1. 30 OctFiled later

    Microsoft's GitHub said AI agents wrote first drafts of over 40% of code change requests in September. In March it was 17%.

  2. 30 OctFiled later

    Microsoft is borrowing at least $25 billion, Bloomberg reported. Its CFO says cloud demand still exceeds what Microsoft can supply.

  3. 30 OctFiled later

    OpenAI's Codex and Microsoft's VS Code are still unpatched, researchers say. They found security flaws in five AI coding tools.

  4. 29 OctFiled later

    Microsoft says Canada Goose cut its month-end close to five days from eight. It had used old software and Excel.

  5. 29 OctFiled later

    Microsoft said Copilot users grew 50% quarter on quarter. CIOs still owe finance a justification for each paid seat.

All 62 Microsoft stories

For your next steering committee

Questions for your own programme. They are not findings about any company in this story.

  1. 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
  2. 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
  3. 3Ask how long a restore took the last time it was tested.

Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01

Founding reader view is on in this browser. It is a reading view, not secure access. Print the working sheet

Founding reader

Welcome back. · Issue 01

2 comments under this story on LinkedIn. Read the discussion

Keep reading

The ERP LEADERS brief Subscribe