https://patchgap.ai/ Only urgent items: being used in real attacks, no patch yet, or critical. Plain English, with the official fix. Check before installing; only use the official link. enSat, 07 Nov 2026 16:04:48 +0000 https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834/https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834/ Wed, 04 Nov 2026 12:00:00 +0000Patched: update now. Install any Apple update from May 2024 or later (most people already did). Apple fixed a browser engine bug in May 2024. On November 4, 2026, CISA said that bug is being used in real attacks. If you installed Apple updates from May 2024 or later, you already have the fix. This mainly matters for a Mac, iPhone, or iPad that has not updated since before mid-May 2024. https://patchgap.ai/incidents/chrome-157-nov-3-security-fixes/https://patchgap.ai/incidents/chrome-157-nov-3-security-fixes/ Tue, 03 Nov 2026 12:00:00 +0000Patched: update now. Update Chrome to 157.0.8103.38 or newer. Google moved Chrome to version 157 on November 3, 2026. It fixes 213 security bugs, and seven are rated 'Critical', which means a bad web page could take over parts of your computer. Google says the update rolls out over the coming days and weeks, and it only works after you close and re-open Chrome. https://patchgap.ai/incidents/chrome-156-oct-29-security-fixes/https://patchgap.ai/incidents/chrome-156-oct-29-security-fixes/ Thu, 29 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 156.0.8078.79 or newer. Google released another Chrome update on October 29, 2026. It fixes 21 security bugs. One is rated 'Critical', which means a bad web page could take over parts of your computer. Chrome downloads the update by itself over the next days, but it only works after you close and re-open Chrome. https://patchgap.ai/incidents/chrome-156-oct-27-security-fixes/https://patchgap.ai/incidents/chrome-156-oct-27-security-fixes/ Wed, 28 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 156.0.8078.73 or newer. Google released a new Chrome update on October 27, 2026. It fixes 52 security bugs. Four are rated 'Critical', which means a bad web page could take over parts of your computer. Chrome downloads the update by itself over the next days, but it only works after you close and re-open Chrome. https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026/https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026/ Wed, 28 Oct 2026 12:00:00 +0000Patched: update now. Update your Mac (Tahoe 26.7.1 / Sequoia 15.8.1 or newer) and your iPhone or iPad (iOS 26.7.1 / 18.7.11 or newer). A bug in the part of Apple's software that draws pictures and files (CoreGraphics) could let a bad file run a program on your Mac, iPhone or iPad. Apple says it was used in a very targeted attack on iPhones. Apple fixed it on September 28, 2026, and on October 26 it sent the same fix to older iPhones and iPads (iOS 18.7.11). The newer October 26 Mac updates also include the fix. https://patchgap.ai/incidents/electrum-wallet-fake-server-fee-bump-theft/https://patchgap.ai/incidents/electrum-wallet-fake-server-fee-bump-theft/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Electrum to 4.8.3. Electrum is a Bitcoin wallet app. It talks to servers to learn about payments. A bad server can hide a payment you just sent and show a fake one that pays a thief instead. If you then use the 'increase fee' button, you sign the fake payment and the thief gets paid. Electrum 4.8.3 fixes this. Electrum says it is already happening. https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit/https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit/ Tue, 27 Oct 2026 12:00:00 +0000Partly patched. Windows: install updates, then check the extra Secure Boot step. Secure Boot is a lock that checks your computer's start-up files. Researchers at Kaspersky found a virus called BlackX that gets past this lock. It uses an old bug that Microsoft fixed in 2023, but the fix is not fully switched on unless an extra step is done by hand. The attacks found so far hit government targets, so most home users are at low risk. Still, it is worth knowing about. https://patchgap.ai/incidents/fearless-wallet-extension-leaks-private-keys/https://patchgap.ai/incidents/fearless-wallet-extension-leaks-private-keys/ Tue, 27 Oct 2026 12:00:00 +0000No patch yet. Fearless Wallet add-on: move your coins to a new wallet now. Fearless Wallet is a browser add-on for storing Polkadot coins. It is not an official Polkadot wallet. The Polkadot Community Foundation says some versions secretly sent your wallet's secret key to a thief's server when you unlocked the wallet. Hackers have already taken coins. Deleting the add-on or changing your password does not help. You have to move your money to a new wallet. https://patchgap.ai/incidents/iphone-ads-and-hijacked-tags-spyware/https://patchgap.ai/incidents/iphone-ads-and-hijacked-tags-spyware/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update your iPhone or iPad to the newest iOS. Researchers say criminals are using bad ads and old, taken-over website pieces (called tags) to attack iPhones that are behind on updates. Just visiting a bad page on an out-of-date iPhone could install spying software that steals saved passwords and crypto wallet data. Phones that are up to date are said to be safe. https://patchgap.ai/incidents/plex-media-server-plex2shell-attacks/https://patchgap.ai/incidents/plex-media-server-plex2shell-attacks/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Plex Media Server to 1.43.3 or newer. If you run Plex Media Server on a PC or Mac, hackers can use a chain of bugs to take over that computer. The US government (CISA) says this is happening now. Plex fixed the problems in Plex Media Server 1.43.3. Plex Desktop 1.115.0 got security fixes too. Update both if you use them. https://patchgap.ai/incidents/chrome-156-security-fixes/https://patchgap.ai/incidents/chrome-156-security-fixes/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 156.0.8078.47 or newer. Google released Chrome 156 on October 20, 2026. It fixes 353 security bugs. Several are rated 'Critical', which means a bad web page could take over parts of your computer. Chrome downloads the update by itself, but it only works after you close and re-open Chrome. https://patchgap.ai/incidents/signal-desktop-call-hang-up-bug/https://patchgap.ai/incidents/signal-desktop-call-hang-up-bug/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Signal Desktop to 8.31.0. Signal's calling code had a bug. Someone on the other end of a call could overload it so your 'hang up' did not fully end the call. News reports said your microphone or camera could stay on. Signal fixed the calling code in version 2.72.0, and Signal Desktop 8.31.0 and newer include the fixed library. https://patchgap.ai/incidents/opencode-windows-sign-in-code-run/https://patchgap.ai/incidents/opencode-windows-sign-in-code-run/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update OpenCode to 1.18.33. OpenCode is an AI helper that works with code. It can connect to outside tools (called MCP servers). On Windows and in WSL, a bad or hijacked tool could make OpenCode run a command on your computer when you start a sign-in to that tool. News reports say version 1.18.33 fixes it, but OpenCode's makers did not announce it. https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026/https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (October 2026 update or newer). Windows normally shows a warning when you open a file you got from the internet or an email. A bug in Windows lets some bad files skip that warning. Hackers are already using this bug. Microsoft fixed it in its October 2026 update (Oct 13). You still have to install that update. https://patchgap.ai/incidents/windows-attacked-bugs-sep-2026/https://patchgap.ai/incidents/windows-attacked-bugs-sep-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (September 2026 update or newer). Two bugs, one in Windows Update itself, let a program that is already on your PC take full control of it. Microsoft fixed it in the September 2026 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/chrome-attacked-bug-sep-2026-b/https://patchgap.ai/incidents/chrome-attacked-bug-sep-2026-b/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 153.0.8010.36 or newer and restart Edge. A bad website could use a bug in the part that runs website code (V8) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 153.0.8010.36. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/chrome-attacked-bug-sep-2026-a/https://patchgap.ai/incidents/chrome-attacked-bug-sep-2026-a/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 152.0.7977.82 or newer and restart Edge. A bad website could use a bug in the part that runs website code (V8) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 152.0.7977.82. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/popcorn-time-time4popcorn-dead-updater/https://patchgap.ai/incidents/popcorn-time-time4popcorn-dead-updater/ Tue, 27 Oct 2026 12:00:00 +0000No patch yet. Remove Popcorn Time (Time4Popcorn). There is no fix. Time4Popcorn is an old movie-streaming app. Its updater looked for updates at a web address nobody owned any more and did not check who sent the update. Anyone who took over that address could send code to every computer with the app. A security company found this and switched the updater off. The app is no longer kept up to date, so there is no real fix. The safe move is to remove it. https://patchgap.ai/incidents/windows-attacked-bugs-aug-2026/https://patchgap.ai/incidents/windows-attacked-bugs-aug-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (August 2026 update or newer). A bug in the part of Windows that handles network connections lets a program that is already on your PC take full control of it. Microsoft fixed it in the August 2026 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026/https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update macOS (Aug 2026 update or newer). If Screen Sharing is turned on, a bug let someone on the same network connect to your Mac without the right password. Apple fixed it on August 6, 2026. Most home users have Screen Sharing turned off. https://patchgap.ai/incidents/chrome-attacked-bug-jun-2026/https://patchgap.ai/incidents/chrome-attacked-bug-jun-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 149.0.7827.102 or newer and restart Edge. A bad website could use a bug in the part that runs website code (V8) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 149.0.7827.102. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026/https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (April 2026 update or newer). A bug in Windows File Explorer lets a bad file or shared folder fool Windows. It can leak your Windows sign-in details to attackers. Microsoft fixed it in the April 2026 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026/https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Check for Defender updates in Windows Security. Microsoft Defender is the antivirus built into Windows. Three bugs in it let a bad program that is already on your PC take more control, or stop Defender from working. Microsoft fixed them in April and May 2026. Defender normally updates itself in the background. https://patchgap.ai/incidents/adobe-reader-attacked-bug-apr-2026/https://patchgap.ai/incidents/adobe-reader-attacked-bug-apr-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Acrobat Reader to 26.001.21411 or newer. Opening a booby-trapped PDF in Adobe Acrobat or Acrobat Reader could let it run its own code on your computer. Attackers were already doing this. Adobe fixed it on April 11, 2026. https://patchgap.ai/incidents/chrome-attacked-bug-apr-2026/https://patchgap.ai/incidents/chrome-attacked-bug-apr-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 146.0.7680.177 or newer and restart Edge. A bad website could use a bug in the part that handles 3D graphics (Dawn) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 146.0.7680.177. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/chrome-attacked-bug-mar-2026/https://patchgap.ai/incidents/chrome-attacked-bug-mar-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 146.0.7680.80 or newer and restart Edge. A bad website could use a bug in the parts that run website code (V8) and draw images (Skia) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 146.0.7680.80. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/chrome-attacked-bug-feb-2026/https://patchgap.ai/incidents/chrome-attacked-bug-feb-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 145.0.7632.75 or newer and restart Edge. A bad website could use a bug in the part that handles page styles (CSS) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 145.0.7632.75. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/apple-attacked-bug-feb-2026/https://patchgap.ai/incidents/apple-attacked-bug-feb-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update macOS and iPhone (26.3 or newer). A bug in a core part of Apple's systems let attackers who already had a foothold run their own code. Apple says it was used against specific people. Apple fixed it in macOS Tahoe 26.3 and iOS 26.3. https://patchgap.ai/incidents/windows-attacked-bugs-feb-2026/https://patchgap.ai/incidents/windows-attacked-bugs-feb-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (February 2026 update or newer). Five Windows bugs were being used by attackers at once. Two let a bad link or file skip the warning Windows normally shows. The others let a program that is already on your PC take more control or crash parts of Windows. Microsoft fixed it in the February 2026 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/office-word-attacked-bug-feb-2026/https://patchgap.ai/incidents/office-word-attacked-bug-feb-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Office (February 2026 update or newer). A bug in Microsoft Word lets a booby-trapped document get around a safety check. Microsoft fixed it in the February 2026 Office update. https://patchgap.ai/incidents/notepad-plus-plus-updater-hijack-2026/https://patchgap.ai/incidents/notepad-plus-plus-updater-hijack-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Download Notepad++ 8.9.1 or newer from notepad-plus-plus.org. Notepad++ is a free text editor for Windows. Its built-in updater did not check that an update really came from Notepad++. Attackers who took over the old hosting company sent fake updates to some chosen targets. Version 8.8.9 added the check, and the maker says to install 8.9.1 or newer. https://patchgap.ai/incidents/office-attacked-bug-jan-2026/https://patchgap.ai/incidents/office-attacked-bug-jan-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Office (January 2026 update or newer). A bug in Microsoft Office lets a booby-trapped document get around a safety check that normally blocks risky content. Attackers sent such documents by email. Microsoft released fixes in January 2026. Microsoft 365 users get the fix after Office restarts; some older Office versions needed extra steps from Microsoft. https://patchgap.ai/incidents/windows-attacked-bugs-jan-2026/https://patchgap.ai/incidents/windows-attacked-bugs-jan-2026/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (January 2026 update or newer). A bug in the part of Windows that draws windows on the screen lets a bad program read secret data from memory. Attackers use it as one step in a bigger attack. Microsoft fixed it in the January 2026 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/apple-webkit-attacked-bug-dec-2025/https://patchgap.ai/incidents/apple-webkit-attacked-bug-dec-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update macOS, Safari and iPhone (26.2 or newer). A bug in WebKit, the engine that shows web pages in Safari and every iPhone browser, let a booby-trapped web page run code on the device. Apple says it was used against specific people. Apple fixed it on December 12, 2025. https://patchgap.ai/incidents/chrome-attacked-bug-dec-2025/https://patchgap.ai/incidents/chrome-attacked-bug-dec-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 143.0.7499.109 or newer and restart Edge. A bad website could use a bug in the part that draws graphics (ANGLE) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 143.0.7499.109. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025/https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (December 2025 update or newer). A bug in the part of Windows that handles cloud files (like OneDrive) lets a program that is already on your PC take full control of it. Microsoft fixed it in the December 2025 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/chrome-attacked-bug-nov-2025/https://patchgap.ai/incidents/chrome-attacked-bug-nov-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update Chrome to 142.0.7444.175 or newer and restart Edge. A bad website could use a bug in the part that runs website code (V8) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 142.0.7444.175. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser. https://patchgap.ai/incidents/windows-attacked-bugs-nov-2025/https://patchgap.ai/incidents/windows-attacked-bugs-nov-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (November 2025 update or newer). Two bugs in Windows let a program that is already on your PC give itself full control of the computer. Both were fixed in the November 2025 update. Microsoft fixed it in the November 2025 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/apple-attacked-bugs-nov-2025/https://patchgap.ai/incidents/apple-attacked-bugs-nov-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Update your Mac and iPhone (Nov 2025 updates or newer). Two bugs in the core of Apple's systems let a bad app take more control of a Mac, iPhone or iPad. Apple fixed them in November 2025. In March 2026 the US government said attackers were using them. https://patchgap.ai/incidents/windows-attacked-bugs-oct-2025/https://patchgap.ai/incidents/windows-attacked-bugs-oct-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Run Windows Update (October 2025 update or newer). Two bugs in Windows let a program that is already on your PC take full control of it. One is in an old modem driver that ships with Windows; Microsoft removed that driver in the October 2025 update. Microsoft fixed it in the October 2025 Windows update. Any newer monthly update also includes the fix. https://patchgap.ai/incidents/winrar-attacked-path-bugs-2025/https://patchgap.ai/incidents/winrar-attacked-path-bugs-2025/ Tue, 27 Oct 2026 12:00:00 +0000Patched: update now. Install WinRAR 7.13 or newer from win-rar.com. WinRAR opens .rar and .zip files. Two bugs let a booby-trapped archive save files outside the folder you chose, for example into your Startup folder so a bad program runs next time you sign in. Attackers sent such files by email. Version 7.13 fixes both. WinRAR does not update itself.