Wednesday , February 19 2025
.NET

Microsoft warn dev urgently to update .NET installer link

Microsoft is forcing .NET developers to quickly update their apps and developer pipelines so they do not use ‘azureedge.net’ domains to install .NET components, as the domain will soon be unavailable due to the bankruptcy and imminent shutdown of CDN provider Edgio.

Specifically, the domains “dotnetcli.azureedge.net” and “dotnetbuilds.azureedge.net” will be taken offline in the next few months, which could break the functionality of projects relying on the domains.

150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

Indian government and educational websites, along with reputable financial brands, have experienced SEO poisoning, causing user traffic to be redirected...
Read More
150 Gov.t Portal affected  Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has found 600 vulnerable PRTG instances in Bangladesh, affected by the...
Read More
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru

Amazon Web Services (AWS) has been named in an FIR after a builder claimed damages to the tune of Rs...
Read More
Builder claims Rs 150 cr for data loss;  AWS faces FIR In Bengaluru

CISA Warns Active Exploitation of Apple iOS Security Flaw

CISA has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, known as CVE-2025-24200, which...
Read More
CISA Warns Active Exploitation of Apple iOS Security Flaw

Massive IoT Data Breach Exposes 2.7 Billion Records

A major IoT data breach has exposed 2.7 billion records, including Wi-Fi network names, passwords, IP addresses, and device IDs....
Read More
Massive IoT Data Breach Exposes 2.7 Billion Records

SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

A serious authentication bypass vulnerability in SonicWall firewalls, called CVE-2024-53704, is currently being exploited, according to cybersecurity firms. The increase...
Read More
SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). If exploited, these could let...
Read More
AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

Lazarus Group Unleashes New Malware Against Developers Worldwide

Lazarus Group has initiated a complex global campaign aimed at software developers and cryptocurrency users. Operation Marstech Mayhem uses the...
Read More
Lazarus Group Unleashes New Malware Against Developers Worldwide

Daily Security Update Dated : 15.02.2025

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated : 15.02.2025

Salt Typhoon to target Bangladeshi Universities, One identified

RedMike (Salt Typhoon) targeted university devices in Bangladesh, likely to access research in telecommunications, engineering, and technology, especially from institutions...
Read More
Salt Typhoon to target Bangladeshi Universities, One identified

This includes developers using .NET installers residing on the affected domains, organizations using GitHub Actions or Azure DevOps with custom pipelines using those domains, Docker and script users with files and code referencing the retired domains, and more.

“We maintain multiple Content Delivery Network (CDN) instances for delivering .NET builds. Some end inazureedge.net. These domains are hosted by edg.io, which will soon cease operations due to bankruptcy. We are required to migrate to a new CDN and will be using new domains going forward,” explains Microsoft.

“It is possible that azureedge.net domains will have downtime in the near-term. We expect that these domains will be permanently retired in the first few months of 2025.”

Microsoft recommends that potentially impacted developers search their code, scripts, and configurations for references to azureedge.net and dotnetcli.blob.core.windows.net and replace them with builds.dotnet.microsoft.com.

During the transition, the new domains will be catered by a combination of Edgio, Akamai, and Azure Front Door, as Microsoft works on solidifying the final distribution model with other CDN providers.

CI/CD teams need to ensure GitHub Actions (actions/setup-dotnet) and Azure DevOps tasks are updated to versions supporting the new domains, while updates for Azure DevOps Server are expected in early 2025.

Additionally, given that new CDN domains will now be used, even when configurations are auto-updated, firewalls need to be set to allow traffic from the new locations (builds.dotnet.microsoft.com and ci.dot.net).

The tech giant notes that the timing is quite unfortunate, as impacted users are requested to take action during the holidays when most IT teams are understaffed.

When asked why Microsoft can’t simply transfer the domains and continue using them, Rich Lander, Program Manager of .NET at Microsoft, said it was not possible.

“We asked the same question. We were told that this option wasn’t being made available. We don’t have more information on that,” explained Lander.

The answer is confusing as Microsoft’s Scott Hanselman confirmed that Microsoft already obtained ownership of the domains, stating that “no other party will ever have access to use these domains.”

By owning the domains and preventing their reuse, the chances of a supply chain compromise for those not migrating their applications are minimal. However, it still doesn’t explain the sudden rush to migrate domains and the risks of operational disruptions.

If you’re impacted, you can follow the issue more closely and access status updates on this GitHub page. Microsoft didnt replay BleepingComputer query regarding the issue.

Check Also

Zuckerberg

Everything I Say Leaks,’ Zuckerberg Says in Leaked Meeting Audio

At an all-hands meeting at Meta on Thursday, Mark Zuckerberg did not mention the company’s …

Leave a Reply

Your email address will not be published. Required fields are marked *