·

Patch week

Exploit code for PHP2Shell is public, and it reaches every PHP install that serves web pages. Update today.

What’s going on

Patch Weather interprets all the fear, chaos and noise into an actionable space for the industry. This week, flaws landed in the software most sites run: PHP2Shell in PHP itself, a Brotli decoder flaw in Node.js, and eMudhra certificates that browsers stopped trusting.

What sets this week apart is reach and public code. Sophos sees scanning and failed attempts against PHP2Shell, and no successful break-in so far.

Update PHP, or ask whoever runs your site to. If nobody does, we can do it for you with the patch check.

PHP

PHP2Shell

What happened
Two flaws in PHP itself let a stranger run their own code on a web server without logging in.
What it means for you
If your site runs on PHP, a stranger could run their own code on your server until PHP is updated.
Being used?
Exploit code is public.Sophos, correction of October 22, 21:21 UTC
The fix
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
How we help
The one-time patch check, $395 per site: where we have access we patch PHP, restart it and confirm the fix from a live page; where only your host can, we ask them in writing.

  • Certificates

    eMudhra certificates blocked by browsers

    What happened
    Eight eMudhra certificate authorities made weak private keys, so browsers stopped trusting them.
    What it means for you
    If your certificate chains to this root, Chrome stops trusting it on October 27 unless a new one is installed.
    Being used?
    The source’s words are on its page.Google Chrome Root Program, Oct 20
    The fix
    No fix yet. Google tells site owners on this root to install a new certificate from another authority before Chrome drops it.
    How we help
    Your host or certificate provider reissues it. If you’re not sure who that is, ask us at jkca.studio and we’ll point you to who reissues it.

  • Node.js

    Brotli decoder flaw

    What happened
    Compressed data built the wrong way can overwrite memory in an app or proxy that unpacks it, which can crash the app, leak memory or run an attacker’s code.
    What it means for you
    If your site or app runs on Node.js, Bun or Envoy and unpacks compressed data from outside, it could crash or be taken over until it is updated.
    Being used?
    Exploit code not published.
    The fix
    Update Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, or Envoy to 1.40.0, 1.39.3, 1.38.6, 1.37.8 or 1.36.12.
    How we help
    Ask us at jkca.studio: tell us what your site runs on and we’ll say whether this flaw reaches it.

  • Your accounts

    Quest Diagnostics patient records

    What happened
    Someone got into Quanum Lab Services Manager, the Quest system some clinics use to order tests and look up results, and reached patient records.
    What it means for you
    If you are a Quest patient, your records may have been reached, and Quest will write to you if they were.
    Being used?
    A breach, not a site flaw.Quest Diagnostics, Oct 23
    What to do
    Nothing is asked of patients yet. Quest says it will mail affected patients when its investigation ends.
    How we help
    This one is on Quest, not on you; watch your mailbox for its letter.

  • Your accounts

    Capcom, 11.7 million accounts

    What happened
    Someone got into CAPCOM ID, the game maker’s account service, and took email addresses and login history. Capcom says card numbers were not included.
    What it means for you
    If you have a CAPCOM ID, expect emails pretending to be Capcom.
    Being used?
    A breach, not a site flaw.Capcom, Oct 22
    What to do
    If an email says it is from Capcom, don’t open its links or attachments.
    How we help
    This one is on Capcom, not on you; watch your inbox for its notice.

Ask for the patch check

Archive, week of August 3, 2026

  • Node.js

    The keyv npm worm

    What happened
    Poisoned versions of keyv and related npm packages steal developer passwords and keys, then spread by poisoning more packages.
    What it means for you
    If whoever builds your site installed a poisoned version, the passwords and keys on that machine may be in a stranger’s hands.
    Being used?
    Being used in attacks.Cyber Security Agency of Singapore, AD-2026-009, Aug 6
    The fix
    No fix yet. CSA says to remove the affected versions, rebuild any machine that installed one, and change the keys and passwords it held.
    How we help
    Ask us at jkca.studio: tell us what your site is built with and we’ll say whether a poisoned package reached it.

488 New CVE records published yesterday, Friday, October 23.

Check your site

Type its address to see what its home page tells anyone who looks.

We look at your home page the way a browser does, once, and keep nothing but a count.

The weekly note

This page, sent to your inbox once a week.

Thanks.

The weekly note starts when the first one goes out.

Built and kept by JKCA Studio, Seal Beach