I'm not in the slightest surprised after all there were 'only' 11-16 security updates this month (depending on OS, etc.)
MS have been notoriously slow with patches, you never know there might be an out of sequence security update if it is considered serious enough.
.NET has been a nightmare for me when on dial-up and only recently got broadband so updated to .net 3.5 SP1, I decided against installing .net 4.0, which is fortunate as it is this new one which is vulnerable.