No chapters are available for this episode.
A Microsoft out-of-band update for CVE-2026-111497 highlights a frustrating gap in business IT maintenance. The Brotli compression flaw affects .NET runtimes, Node.js, and other platforms, but patching the host server doesn’t automatically fix self-contained applications or containerised workloads. Noel Bradford walks through what the vulnerability actually does, why one shared component means multiple suppliers fixing on separate timetables, and how bundled runtimes can sit unchanged inside applications long after the underlying server receives its updates. Using the example of a small Horsham firm whose booking app could remain vulnerable despite monthly server patching, the episode makes the case for asking suppliers four specific questions: which systems contain the flaw, what can reach it, who owns each fix, and how will you prove the live application now runs the corrected component. The episode closes with a reminder that green ticks on infrastructure reports mean very little if nobody checks whether the software customers actually use received the update.