See https://kb.sitecore.net/articles/760963 or my blog post at https://grantkillian.wordpress.com/2019/01/17/new-sitecore-8-2-sitecore-9-security-patch/ for full context

SitecoreSecurityPatch.SC2019-001-302938.ps1

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
Import-Module WebAdministration

$url = "https://kb.sitecore.net/~/media/7A638A36A71D4494981A8655E297AD23.ashx?la=en"
$tempLocation = "C:\tempLocation"
$zippedPatch = "$tempLocation\SitecoreSupportPackage.302938.zip"
$unzippedPatch = "$tempLocation\SitecoreSupportPackage"
$sitecoreRoot = "C:\InetPub\Your\Sitecore\Website"

if (!(Test-Path $tempLocation))
{
    New-Item -ItemType Directory -Path $tempLocation
}
Invoke-WebRequest -Uri $url -OutFile $zippedPatch 
Expand-Archive -Path $zippedPatch -DestinationPath $unzippedPatch -Force
Copy-Item "$unzippedPatch/website/*" -Destination $sitecoreRoot -Recurse -Force
Write-Host "Patch applied to $sitecoreRoot"

Remove-Item $unzippedPatch -Recurse
Remove-Item $zippedPatch  -Recurse