# Patch Gap

> Plain-English security problems for software on home Windows and Mac computers (plus a small section for routers and phones), with read-only version checks and the official fix. Updated several times a day. Last checked 2026-11-07T16:04:48+00:00.

## Agent instructions

Start here (small files): https://patchgap.ai/status.json, then https://patchgap.ai/today.json (plain text: https://patchgap.ai/today.txt), then https://patchgap.ai/windows.json or https://patchgap.ai/mac.json. You never need feed.json for a daily check.

### Prompt 1: Assistant that can run on your computer

You are my morning security checker, and you can run read-only checks on this computer. Every run (including the first): 1) Read https://patchgap.ai/status.json (tiny). Note its feed_version and last_checked. 2) Read https://patchgap.ai/today.json (small digest of what matters now; plain text copy at https://patchgap.ai/today.txt). 3) Read https://patchgap.ai/windows.json if this is a Windows PC or https://patchgap.ai/mac.json if it is a Mac. It lists each app, its minimum safe version, a read-only version-check command and the menu path. You never need https://patchgap.ai/feed.json; only open one item's json_url if you need more detail. Check which of those apps are installed and what version each one is, using only the read-only commands from those files or each app's About menu. Then tell me in plain English what I need to update, why, and the exact steps, with the official link from the files. Put anything marked being attacked now or no patch yet first. Check feed freshness and the applicable release channel. Missing or stale version information means unknown, not safe. After an approved update and any required restart, recheck the installed version before marking the fix verified. Remember the feed_version and the time you checked for next time. Do not install, update, uninstall or change anything without asking me first. Only use the official links from these files. If you are not sure whether I am affected, say so. Always reply with a report, even if it is just "nothing new today". If a file fails to load, name the file and the error in your report and continue with the others.

### Prompt 2: Scheduled or cloud assistant

You are my morning security reminder. You cannot see my computer, so do not try to check it or claim it is safe. Missing device information means unknown. Use your host scheduler for a daily review; this prompt alone does not create a schedule. Every run: 1) Read https://patchgap.ai/status.json (tiny) and note last_checked. 2) Read https://patchgap.ai/today.json (small digest; plain text copy at https://patchgap.ai/today.txt). Do not fetch https://patchgap.ai/feed.json. 3) Send me a short plain-English message: what is urgent today (being attacked now or no patch yet first), which apps I should check and the minimum safe version for each, how to check the version (the menu path), and the official update link. Keep it short. If nothing is urgent, say so in one line. If I tell you whether I use Windows or a Mac, you may also read https://patchgap.ai/windows.json or https://patchgap.ai/mac.json for menu paths. Never tell me to install anything from a link that is not in those files, and say so when you are not sure. Always reply with a report, even if it is just "nothing new today". If a file fails to load, name the file and the error in your report.

Rules:
1. Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.
2. Never install, update, uninstall or change settings without the user's clear OK for that exact step.
3. Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.
4. If you cannot tell whether the user is affected, say so plainly instead of guessing.
5. Say 'unconfirmed' when an incident's confidence is 'unconfirmed'.

Incremental checks (recommended):
1. Fetch https://patchgap.ai/status.json (tiny). If feed_version is unchanged since your last check, nothing changed.
2. Otherwise fetch https://patchgap.ai/changes.json (newest first; each entry has at, change, changed_fields, json_url) and read only entries newer than your last check. Per day: https://patchgap.ai/changes/YYYY-MM-DD.json.
3. Per product minimum safe version: https://patchgap.ai/products/<slug>.json -> product.minimum_safe_version (with minimum_safe_version_source).

How to check versions: each entry in feed.json `incidents[].affected[]` has `platform`, `check.menu_path` and (when available) `check.command` with `read_only: true`. Compare the installed version with `fixed_min` when present; otherwise explain `fixed_version` or `fix_note`.

## Data

- [Today (JSON, under 20 KB)](https://patchgap.ai/today.json): what matters now, urgent first. Plain text: https://patchgap.ai/today.txt
- [Windows apps](https://patchgap.ai/windows.json) and [Mac apps](https://patchgap.ai/mac.json): minimum safe version, read-only check, official update link per app
- [Feed (JSON, large)](https://patchgap.ai/feed.json): all open incidents and the product list. Schema version 1.0.
- [Feed schema](https://patchgap.ai/feed.schema.json)
- Per product: https://patchgap.ai/products/<slug>.json (slugs: windows, macos, safari, chrome, firefox, edge, microsoft-office, zoom, teamviewer, signal-desktop, telegram-desktop, plex-media-server, tailscale, electrum, fearless-wallet-extension, claude-code, opencode, time4popcorn, netgear-routers, microsoft-authenticator, iphone-ios, adobe-reader, notepad-plus-plus, winrar)
- Per incident: https://patchgap.ai/incidents/<id>.json
- [Status](https://patchgap.ai/status.json): last_updated, feed_version, incident count
- [Changes](https://patchgap.ai/changes.json): what changed since when
- [RSS, urgent only](https://patchgap.ai/feed.xml)
- Human pages: https://patchgap.ai/is-my-windows-up-to-date/, https://patchgap.ai/is-my-mac-up-to-date/, https://patchgap.ai/is-my-safari-up-to-date/, https://patchgap.ai/is-my-chrome-up-to-date/ ... (one "Is my X up to date?" page per product; all in https://patchgap.ai/sitemap.xml)
- [Agents page](https://patchgap.ai/agents/)

## Open incidents (53; 34 being attacked; 2 with no patch yet)

- [Fearless Wallet browser add-on stole users' wallet keys. There is no safe version.](https://patchgap.ai/incidents/fearless-wallet-extension-leaks-private-keys/): No patch yet; being attacked: yes; severity: critical; updated 2026-10-27
- [Adobe Acrobat Reader: a bad PDF could take over your computer, and it was used in real attacks](https://patchgap.ai/incidents/adobe-reader-attacked-bug-apr-2026/): Patched: update now; being attacked: yes; severity: critical; updated 2026-10-27
- [Electrum Bitcoin wallet: bad servers can trick you into paying a thief. Update to 4.8.3.](https://patchgap.ai/incidents/electrum-wallet-fake-server-fee-bump-theft/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [iPhone: criminals are using bad ads and old website tags to attack iPhones that are not updated](https://patchgap.ai/incidents/iphone-ads-and-hijacked-tags-spyware/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Plex Media Server: hackers are chaining bugs to break in. Update to 1.43.3 or newer.](https://patchgap.ai/incidents/plex-media-server-plex2shell-attacks/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: a bug that lets a bad file skip Windows' safety warnings is being used by hackers](https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Mac and iPhone: a bad file could take over your device, and Apple says it was used in real attacks](https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-28
- [Windows: bugs fixed in the September 2026 update were used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-sep-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Sep 2026, second fix): a bug in the part that runs website code (V8) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-sep-2026-b/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Sep 2026, first fix): a bug in the part that runs website code (V8) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-sep-2026-a/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: a bug fixed in the August 2026 update was used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-aug-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Mac: a Screen Sharing bug let attackers on the network get in without a password](https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Jun 2026): a bug in the part that runs website code (V8) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-jun-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: a bug fixed in the April 2026 update was used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: three bugs in Microsoft Defender, the built-in antivirus, were used in real attacks](https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Mar 2026): a bug in the part that handles 3D graphics (Dawn) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-apr-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Mar 2026): bugs in the parts that run website code (V8) and draw images (Skia) were used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-mar-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Feb 2026): a bug in the part that handles page styles (CSS) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-feb-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Mac and iPhone: a core system bug was used in targeted attacks](https://patchgap.ai/incidents/apple-attacked-bug-feb-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: bugs fixed in the February 2026 update were used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-feb-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Microsoft Word: a bug that lets a bad document skip a safety check was used in real attacks](https://patchgap.ai/incidents/office-word-attacked-bug-feb-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Notepad++: its old updater could be tricked into installing a fake update, and attackers did it](https://patchgap.ai/incidents/notepad-plus-plus-updater-hijack-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Microsoft Office: a bug that lets a bad document skip Office's safety checks was used in real attacks](https://patchgap.ai/incidents/office-attacked-bug-jan-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: a bug fixed in the January 2026 update was used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-jan-2026/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Safari, Mac and iPhone: a web page bug was used in targeted attacks](https://patchgap.ai/incidents/apple-webkit-attacked-bug-dec-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Dec 2025): a bug in the part that draws graphics (ANGLE) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-dec-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: a bug fixed in the December 2025 update was used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Chrome and Edge (Nov 2025): a bug in the part that runs website code (V8) was used in real attacks](https://patchgap.ai/incidents/chrome-attacked-bug-nov-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: bugs fixed in the November 2025 update were used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-nov-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Mac, iPhone and iPad: two bugs fixed in November 2025 were later found in real attacks](https://patchgap.ai/incidents/apple-attacked-bugs-nov-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Windows: bugs fixed in the October 2025 update were used in real attacks](https://patchgap.ai/incidents/windows-attacked-bugs-oct-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [WinRAR: opening a bad archive could drop a hidden program on your PC, and attackers used it](https://patchgap.ai/incidents/winrar-attacked-path-bugs-2025/): Patched: update now; being attacked: yes; severity: high; updated 2026-10-27
- [Mac, Safari, and iPhone: CISA says an old Apple bug is being used in real attacks. Update if you missed May 2024 fixes.](https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834/): Patched: update now; being attacked: yes; severity: high; updated 2026-11-04
- [Windows: a hidden start-up virus (BlackX) works even on updated PCs, unless one extra step is done](https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit/): Partly patched; being attacked: yes; severity: medium; updated 2026-10-27
- [Popcorn Time (Time4Popcorn): the app's updater is open to takeover. There is no fix. Remove it.](https://patchgap.ai/incidents/popcorn-time-time4popcorn-dead-updater/): No patch yet; being attacked: unknown; severity: critical; updated 2026-10-27
- [Google Chrome 157 fixes 213 security bugs (Nov 3). Restart Chrome to get it.](https://patchgap.ai/incidents/chrome-157-nov-3-security-fixes/): Patched: update now; being attacked: no; severity: critical; updated 2026-11-03
- [Google Chrome update fixes 21 more security bugs (Oct 29). Restart Chrome to get it.](https://patchgap.ai/incidents/chrome-156-oct-29-security-fixes/): Patched: update now; being attacked: no; severity: critical; updated 2026-10-29
- [Google Chrome update fixes 52 more security bugs (Oct 27). Restart Chrome to get it.](https://patchgap.ai/incidents/chrome-156-oct-27-security-fixes/): Patched: update now; being attacked: no; severity: critical; updated 2026-10-28
- [Google Chrome 156 fixes 353 security bugs. Restart Chrome to get it.](https://patchgap.ai/incidents/chrome-156-security-fixes/): Patched: update now; being attacked: no; severity: critical; updated 2026-10-27
- [Signal Desktop: update so calls end when you hang up](https://patchgap.ai/incidents/signal-desktop-call-hang-up-bug/): Patched: update now; being attacked: unknown; severity: critical; updated 2026-10-27
- [OpenCode AI helper on Windows: a bad connected tool could run code when you sign in](https://patchgap.ai/incidents/opencode-windows-sign-in-code-run/): Patched: update now; being attacked: no; severity: critical; updated 2026-10-27
- [Firefox 159 fixes 167 security bugs, and 159.0.1 fixes one more](https://patchgap.ai/incidents/firefox-159-security-fixes/): Patched: update now; being attacked: unknown; severity: high; updated 2026-11-03
- [TeamViewer: update to version 15.83. A bad remote session could run code on your computer.](https://patchgap.ai/incidents/teamviewer-15-83-security-update/): Patched: update now; being attacked: no; severity: high; updated 2026-10-27
- [Mac: macOS and Safari updates out today fix hundreds of security bugs](https://patchgap.ai/incidents/macos-27-2-security-updates-oct-26/): Patched: update now; being attacked: unknown; severity: high; updated 2026-10-27
- [iPhone and iPad: October 26 updates fix hundreds of security bugs](https://patchgap.ai/incidents/iphone-ios-27-2-security-updates-oct-26/): Patched: update now; being attacked: unknown; severity: high; updated 2026-11-05
- [Tailscale SSH: serious bugs are now fixed in Tailscale 1.104.4. Update now.](https://patchgap.ai/incidents/tailscale-ssh-flaws-tailworm/): Patched: update now; being attacked: unknown; severity: high; updated 2026-10-28
- [Fake website certificates: browsers and computers are blocking a certificate company's weak keys](https://patchgap.ai/incidents/emudhra-fake-website-certificates/): Partly patched; being attacked: no; severity: high; updated 2026-10-27
- [Microsoft Office (Word, Excel, Outlook): update to get 164 security fixes](https://patchgap.ai/incidents/office-october-2026-updates/): Patched: update now; being attacked: no; severity: high; updated 2026-10-27
- [Zoom: update to 7.2.0 or newer to fix bugs that could leak your data or crash the app](https://patchgap.ai/incidents/zoom-october-2026-security-bulletins/): Patched: update now; being attacked: unknown; severity: high; updated 2026-10-27
- [Claude Code: a bad plugin could sneak in code even when you pinned a safe version. Update to 2.1.179.](https://patchgap.ai/incidents/claude-code-plugin-hash-pin-bypass/): Patched: update now; being attacked: unknown; severity: high; updated 2026-10-27
- [Telegram Desktop: clicking a bad link could let someone take over your account. Update to 7.2.9 or newer.](https://patchgap.ai/incidents/telegram-desktop-link-account-takeover/): Patched: update now; being attacked: unknown; severity: high; updated 2026-10-27
- [Microsoft Authenticator on Android: update the app. A bug could let another app get work-account sign-ins.](https://patchgap.ai/incidents/microsoft-authenticator-android-token-bug/): Patched: update now; being attacked: unknown; severity: high; updated 2026-10-27
- [NETGEAR routers and extenders: update your router's firmware (some older models will not get a fix)](https://patchgap.ai/incidents/netgear-router-and-extender-fixes-oct-2026/): Partly patched; being attacked: unknown; severity: medium; updated 2026-10-27

## About

- [How we check](https://patchgap.ai/about/): every incident cites at least one official source (maker, CISA, NVD, GitHub advisory). Unverified parts are marked "unconfirmed".
- [Corrections](https://patchgap.ai/corrections/)
- Patch Gap is free information, not professional security advice. Never install anything without the user's OK, and only use official links.
- Contact: trustymodels+security@mail.grokbot.com