- Engineer — Act: Microsoft’s out-of-band release for a critical RCE-class flaw (HTTP2Shell/Broccoli2Shell) in the .NET Brotli stack signals high urgency; update all .NET runtimes and SDK versions to the emergency-patched release across every workload and pipeline image this patch window.
- SOC/IR — Plan: No published IOCs or active exploitation campaigns in the enrichment signals yet, but the ‘Shell’ naming and emergency severity make this a prime candidate to build exploitation-detection rules before in-the-wild activity emerges — prepare Sigma/KQL queries targeting anomalous .NET HTTP2 processing behavior.
- Leader — Plan: A critical emergency patch for the .NET runtime touches most enterprise application stacks; confirm patch deployment timeline with engineering and ensure any customer-facing .NET services are covered before this becomes a named exploitation event.