Low Severity
CVE-2026-109618
Published: Nov 5, 2026
When a vulnerability gets traction, patch now. Claude Code plugin + zero-dependency scanner that finds the vulnerabilities spreading right now (OSV, NVD, CISA KEV, EPSS, the news) and patches them with you.
<p align="center"><img src="docs/hero.svg" alt="patchhero flying toward the viewer; behind it, the beaten names Heartbleed, Shellshock, WannaCry, Log4Shell, xz backdoor, PHP2Shell and the 2026 fridge hack" width="100%"></p>
# patchhero
**When a vulnerability gets traction, patch now.**
A Claude Code plugin and zero-dependency scanner that finds the vulnerabilities in your project that matter *today* (not the 400 you can ignore), tells you exactly what to change, and patches them with you. It alerts the moment you open a project, runs on a schedule in GitHub Actions, and explains every priority in plain words for people who never had a security background.
<p align="center"><img src="docs/demo.svg" alt="patchhero scan of examples/php-app the morning after PHP2Shell: P0 PHP 8.3.30 in Dockerfile, upgrade to 8.3.36" width="100%"></p>
That is the real output for [`examples/php-app`](examples/php-app) on 22 October 2026, the morning after [PHP2Shell](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) (CVE-2026-109618 and CVE-2026-109619) was disclosed. It was not yet in CISA's exploited list and its EPSS score was 5%, so tools that rely on one signal called it "medium". patchhero called it P0, because it combines five signals: CVSS, CISA KEV, EPSS, disclosure age, and whether the vendor just shipped an emergency release.
The names on the banner are real: Heartbleed, Shellshock, WannaCry, Log4Shell, the xz backdoor, PHP2Shell, and the October 2026 attack that heated the fridges of hundreds of French supermarkets to 50 °C through refrigeration controllers running firmware nobody updated. Different bugs, one pattern: the fix existed, and the software kept running without it. patchhero exists so that the next one is caught the morning it breaks, in every project you open, not months later from a customer.
## What you get
1. **An alert when you open the project.** A SessionStart hook scans the project (cached six