Geoffrey Vandiest
I know teams that have not upgraded yet. Still on .NET 8, some on .NET 9. And it is never a surprise which teams. The same ones that were late for .NET 6, late for .NET Core, and whose releases you learn to check twice. The runtime version is not the problem. It is the symptom.
On 10 November, .NET 8 and .NET 9 stop receiving security patches. That is in four weeks. After that date, every vulnerability found in those runtimes stays open. Forever.
And this is the easiest upgrade we have ever had. The move from .NET Framework to .NET Core was a project: months of work, broken libraries, rewritten startup code. .NET 8 to .NET 10 is one line in the project file. net8.0 becomes net10.0. Restore, build, run the tests. The breaking changes fit on a short page, and most of them concern things you never used. Azure has supported .NET 10 since last year.
An afternoon. A week for a large application. A team that cannot find that afternoon in a year is telling you something about the rest of its code.
This month Microsoft shipped fixes for 1,413 vulnerabilities across its products, its largest monthly release ever. One was already being used by attackers. So ask yourself: how many of this month's fixes, and next month's, touch code that also lives in your .NET 8 runtime? You will never know. After 10 November, Microsoft stops telling you.
An unsupported runtime is not "the same code as last year". It is the same code, plus every bug found since, minus every fix.
And in the age of AI, this is a different risk. Five years ago an exploit took a skilled attacker weeks. Today an agent reads the patch diff, writes the exploit and scans the internet for targets in one afternoon. A runtime that will never be fixed is not a risk you take. It is a gift you hand out.
Why do we get away with it? Because it costs nothing. When a company leaks customer data through a bug patched two years earlier, the customers carry the loss. The company issues a statement, offers a year of credit monitoring, and moves on.
Imagine the rule was different. Imagine a company that leaked data through a known, patched, unapplied vulnerability had to pay back the real damage to every affected user. Not a fine that disappears into a budget. The actual loss, to the actual people.
Then that afternoon of upgrade work would be the best investment on the whole roadmap. Every CTO would find the time.
We are not lazy because the upgrade is hard. We are lazy because, so far, nobody has sent us the bill.
Change the target framework. Run the tests. Do it this week.
First published on LinkedIn.