The Brotli flaw is in .NET now: Microsoft's out-of-band patch, and the self-contained trap

Yesterday I wrote about HTTP2Shell: CVE-2026-111497, a buffer overflow in the Brotli decoder that ended up in Node.js's HTTP stack and a long tail of Python packages. Today the same CVE forced Microso