For anyone that runs any web-facing IIS machines this has to be treated as a DEFCON 1 situation.