The correct way to do this is immediately release a bulletin to admins to block the affected service, then push a patch to disable it, then push a patch to fix

The correct way to do this is immediately release a bulletin to admins to block the affected service, then push a patch to disable it, then push a patch to fix and reenable it when they feel ready. It's only unwinable because Microsoft refuses to take a PR/cash hit of telling people to stop using something while it's broken.