Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Fix availableCritical · CVSS 9.8EPSS 0.99%

Published Oct 13, 2026 · updated Oct 13, 2026

What to do

  1. Upgrade to a fixed version: Microsoft.Native.Quic.MsQuic.Schannel 2.5.11-ci.159417053.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

NuGetMicrosoft.Native.Quic.MsQuic.Schannel

Vulnerable versions
= 2.5.11-ci.156755675
Fixed in
2.5.11-ci.159417053

Check your project: dotnet list package --include-transitive | grep -i Microsoft.Native.Quic.MsQuic.Schannel

Sources

CWE-122 Heap-based Buffer Overflow

← All critical vulnerabilities