Act
active
Microsoft emergency .NET patches for critical Brotli/HTTP2Shell flaw
- Engineer — Act: Microsoft’s out-of-band release for a critical RCE-class flaw (HTTP2Shell/Broccoli2Shell) in the .NET Brotli stack signals high urgency; update all .NET runtimes and SDK versions to the emergency-patched release across every workload and pipeline image this patch window.
- SOC/IR — Plan: No published IOCs or active exploitation campaigns in the enrichment signals yet, but the ‘Shell’ naming and emergency severity make this a prime candidate to build exploitation-detection rules before in-the-wild activity emerges — prepare Sigma/KQL queries targeting anomalous .NET HTTP2 processing behavior.
- Leader — Plan: A critical emergency patch for the .NET runtime touches most enterprise application stacks; confirm patch deployment timeline with engineering and ensure any customer-facing .NET services are covered before this becomes a named exploitation event.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.