The Old3DS+New3DS 10.3.0-28 system update was released on November 9, 2015. This Old3DS update was released for the following regions: USA, EUR, JPN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, and KOR.
Security flaws fixed: no.
Official USA change-log:
- Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience
Exactly 4 functions were updated, these functions appear to be gfx related.
Server-side NNID NVer update
The URL used for NNID login(domain is account.nintendo.net) now returns a sysupdate-required error when the 3DS sends a NVer value that's older than the one for X.X.X-28. With this change at the time this update was released, the installed NVer has to be at minimum the one from 10.2.0-28. This was a server-side change. This HTTPS request is done by the act sysmodule.
This apparently also affects systems which don't have NNID-linked, it's unknown when exactly this change was done server-side(it was after v10.3 release at least).
System update report(s):