Microsoft has released emergency security updates for .NET to fix a critical vulnerability linked to Brotli compression, referred to in reports as Broccoli2Shell and also tracked under the names Node2Shell and HTTP2Shell. While technical details may continue to develop, the immediate business message is clear: organisations using affected .NET environments should review Microsoft’s guidance and prioritise patching.

What happened

According to the reported update, Microsoft issued out-of-band .NET security patches rather than waiting for a regular monthly release cycle. That typically signals a vulnerability serious enough to justify accelerated remediation.

The flaw has been described as critical and associated with Brotli, a compression technology used in web delivery and application traffic handling. The issue has also been referred to by multiple names in public reporting, including Broccoli2Shell, Node2Shell and HTTP2Shell. Based on the available source information, businesses should rely on Microsoft’s official advisories and product-specific update instructions for the confirmed list of affected versions and deployment steps.

Why it matters for European businesses

For many European companies, .NET supports customer portals, e-commerce functions, internal tools, APIs and line-of-business applications. A critical vulnerability in that stack can create risk well beyond IT operations.

If an exposed application or service is vulnerable, the consequences may include service disruption, compromise of application infrastructure or follow-on security incidents affecting customer data and business operations. For SMEs in particular, delayed patching can create a disproportionate risk because internet-facing systems are often managed by small internal teams or external agencies with limited capacity.

This matters especially where .NET applications connect to payment processes, CRM platforms, ERP systems, employee portals or cloud-hosted workloads. In regulated sectors, a serious application-layer vulnerability may also raise incident response and compliance considerations if exploitation leads to personal data exposure or operational impact.

Who may be affected

• Businesses running Microsoft .NET applications on servers, cloud instances or managed platforms
• E-commerce companies using .NET-based storefronts, APIs or back-office systems
• IT teams and managed service providers responsible for patching Windows and application runtimes
• Digital agencies and software vendors maintaining client websites, portals or custom business applications built on .NET
• Organisations with internet-facing services that use affected components in production environments

What companies should consider

• Check whether your systems use affected .NET versions and identify all production, staging and development environments that may require updates.
• Prioritise emergency patching for internet-facing applications and critical business services, especially where they process customer requests or expose APIs.
• Review vendor and hosting dependencies if your software is maintained by a third party, SaaS supplier or development agency. Confirm whether they have applied the relevant fixes.
• Test key business workflows after patching to reduce the risk of unexpected disruption to websites, integrations and internal applications.
• Increase monitoring for unusual application behaviour, failed requests or signs of attempted exploitation while patching is underway.
• Update incident response plans if affected systems handle sensitive or regulated data, so teams can act quickly if suspicious activity is identified.

At this stage, the most practical step for businesses is to treat the issue as a high-priority patch management event. Companies should avoid assuming they are unaffected simply because they do not directly develop software in-house; many websites, customer systems and business applications rely on .NET through external providers or legacy deployments.