Microsoft: Thousands of Public ASP.NET Keys Allow Web Server RCE

Microsoft warns that developers are importing publicly disclosed ASP.NET machine keys from documentation and code repositories, enabling attackers to craft malicious ViewState payloads that bypass validation and execute code in IIS worker processes. Microsoft observed threat actors in December using a static known key with the Godzilla post‑exploitation framework and identified roughly 3,000 publicly disclosed keys; organizations are advised to stop copying public keys and to rotate machine keys regularly to mitigate remote code execution risk.