Patch Weather https://patchweather.com/ Patch Weather is a weekly plain-words report of the website security flaws that matter to small businesses, each checked against its source. en-us PHP2Shell (CVE-2026-109618, CVE-2026-109619) https://patchweather.com/flaws/php2shell/ https://patchweather.com/flaws/php2shell/ Fri, 23 Oct 2026 12:00:00 GMT Two flaws in PHP itself let a stranger run their own code on a web server without logging in. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Brotli decoder flaw (CVE-2026-111497) https://patchweather.com/flaws/node-brotli/ https://patchweather.com/flaws/node-brotli/ Fri, 23 Oct 2026 12:00:00 GMT Compressed data built the wrong way can overwrite memory in an app or proxy that unpacks it, which can crash the app, leak memory or run an attacker’s code. Fixed in Node.js 22.23.4, 24.22.1 or 26.12.1, Bun 1.4.4 and Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8 or 1.36.12. eMudhra certificates blocked by browsers https://patchweather.com/flaws/emudhra/ https://patchweather.com/flaws/emudhra/ Fri, 23 Oct 2026 12:00:00 GMT Eight eMudhra certificate authorities made weak private keys, so browsers stopped trusting them. No fix yet. Quest Diagnostics patient records https://patchweather.com/flaws/quest/ https://patchweather.com/flaws/quest/ Fri, 23 Oct 2026 12:00:00 GMT Someone got into Quanum Lab Services Manager, the Quest system some clinics use to order tests and look up results, and reached patient records. Capcom, 11.7 million accounts https://patchweather.com/flaws/capcom/ https://patchweather.com/flaws/capcom/ Fri, 23 Oct 2026 12:00:00 GMT Someone got into CAPCOM ID, the game maker’s account service, and took email addresses and login history. Capcom says card numbers were not included. The keyv npm worm https://patchweather.com/flaws/keyv-worm/ https://patchweather.com/flaws/keyv-worm/ Fri, 23 Oct 2026 12:00:00 GMT Poisoned versions of keyv and related npm packages steal developer passwords and keys, then spread by poisoning more packages. No fix yet. Node.js security flaws https://patchweather.com/stacks/node/ https://patchweather.com/stacks/node/ Every Node.js security flaw on Patch Weather, newest first. Is my site affected? https://patchweather.com/is-my-site-affected/ https://patchweather.com/is-my-site-affected/ How to tell what software your website runs.