Patch early, part two. Now with .NET.

Two days ago it was PHP. On Saturday Microsoft pushed an emergency patch for .NET 8, 9 and 10, outside the monthly cycle. The bug is in the Brotli decoder, the same one that gave Node.js its "Node2Shell" moment last week. One crafted compressed stream, and an attacker reads or rewrites your process memory. Lovely.

Best part: the fix has been sitting in Brotli's source code since 27 February. Nobody labelled it a security fix. Eight months later, Node.js, Python, Bun, Envoy and .NET all discovered it in the same week. Teamwork.

Welcome to 2026. AI agents read commit diffs faster than humans write advisories. "We'll upgrade next quarter" is no longer a plan. It is an invitation.

And no, patching the server is not enough. Self-contained apps and containers bring their own runtime. Rebuild them, or enjoy a false sense of security with a fresh coat of paint.

Patch early and be happy.

First published on LinkedIn.