{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "macos",
  "name": "macOS",
  "short_name": "Mac",
  "page_url": "https://patchgap.ai/is-my-mac-up-to-date/",
  "minimum_safe_version": null,
  "minimum_safe_version_source": [
   {
    "url": "https://support.apple.com/en-us/149521",
    "title": "Apple: About the security content of macOS Golden Gate 27.2",
    "date": "2026-10-26",
    "kind": "vendor"
   },
   {
    "url": "https://support.apple.com/en-us/149522",
    "title": "Apple: About the security content of macOS Tahoe 26.7.2",
    "date": "2026-10-26",
    "kind": "vendor"
   },
   {
    "url": "https://support.apple.com/en-us/149523",
    "title": "Apple: About the security content of macOS Sequoia 15.8.2",
    "date": "2026-10-26",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": null,
   "applies_to": null,
   "source_incident": "macos-27-2-security-updates-oct-26",
   "sources": [
    {
     "url": "https://support.apple.com/en-us/149521",
     "title": "Apple: About the security content of macOS Golden Gate 27.2",
     "date": "2026-10-26",
     "kind": "vendor"
    },
    {
     "url": "https://support.apple.com/en-us/149522",
     "title": "Apple: About the security content of macOS Tahoe 26.7.2",
     "date": "2026-10-26",
     "kind": "vendor"
    },
    {
     "url": "https://support.apple.com/en-us/149523",
     "title": "Apple: About the security content of macOS Sequoia 15.8.2",
     "date": "2026-10-26",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": false,
   "newest_fix": "27.2 (Golden Gate) / 26.7.2 (Tahoe) / 15.8.2 (Sequoia)",
   "caveats": [
    "Only partly fixed so far, so also follow the extra steps on their pages: emudhra-fake-website-certificates.",
    "These are fixed by an update without one version number we can compare, so check their pages: apple-attacked-bug-feb-2026, apple-attacked-bugs-nov-2025, apple-webkit-attacked-bug-dec-2025, apple-webkit-pointer-auth-cve-2024-27834, emudhra-fake-website-certificates, macos-27-2-security-updates-oct-26, macos-coregraphics-zero-day-sept-2026, macos-screen-sharing-attacked-bug-aug-2026."
   ],
   "text": "There is no single version number for Mac. The newest fix listed here is: 27.2 (Golden Gate) / 26.7.2 (Tahoe) / 15.8.2 (Sequoia). If you have that or anything newer, you're covered against the fixed problems listed here (see the notes below)."
  },
  "update_steps": {
   "macos": [
    "Apple menu > System Settings > General > Software Update.",
    "Install the update it offers.",
    "Restart when asked."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Apple",
  "category": "mac",
  "platforms": [
   "macos"
  ],
  "what_it_is": "The operating system on Mac laptops and desktops.",
  "url": "https://patchgap.ai/is-my-mac-up-to-date/",
  "json_url": "https://patchgap.ai/products/macos.json",
  "official_site": "https://www.apple.com/macos",
  "official_download": "https://support.apple.com/en-us/108382",
  "how_it_updates": "Software Update in System Settings. Apple can also install small background fixes by itself.",
  "check": {
   "macos": {
    "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
    "command": "sw_vers -productVersion",
    "shell": "Terminal",
    "read_only": true
   }
  },
  "open_incidents": [
   "macos-coregraphics-zero-day-sept-2026",
   "macos-screen-sharing-attacked-bug-aug-2026",
   "apple-attacked-bug-feb-2026",
   "apple-webkit-attacked-bug-dec-2025",
   "apple-attacked-bugs-nov-2025",
   "apple-webkit-pointer-auth-cve-2024-27834",
   "macos-27-2-security-updates-oct-26",
   "emudhra-fake-website-certificates"
  ]
 },
 "incidents": [
  {
   "id": "macos-coregraphics-zero-day-sept-2026",
   "url": "https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026/",
   "path": "/incidents/macos-coregraphics-zero-day-sept-2026/",
   "json_url": "https://patchgap.ai/incidents/macos-coregraphics-zero-day-sept-2026.json",
   "title": "Mac and iPhone: a bad file could take over your device, and Apple says it was used in real attacks",
   "category": "mac",
   "platforms": [
    "macos",
    "ios"
   ],
   "products": [
    "macos",
    "iphone-ios"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "NVD score 8.8 out of 10 (CVE-2026-86950)",
   "exploited_in_wild": "yes",
   "exploited_note": "Apple says it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iPhones before iOS 27. CISA lists it as exploited (added Sept 29, 2026).",
   "exploited_source_url": "https://support.apple.com/en-us/149229",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-09-28",
   "updated_at": "2026-10-28",
   "cves": [
    "CVE-2026-86950"
   ],
   "summary": "A bug in the part of Apple's software that draws pictures and files (CoreGraphics) could let a bad file run a program on your Mac, iPhone or iPad. Apple says it was used in a very targeted attack on iPhones. Apple fixed it on September 28, 2026, and on October 26 it sent the same fix to older iPhones and iPads (iOS 18.7.11). The newer October 26 Mac updates also include the fix.",
   "am_i_affected": "You are at risk if your Mac runs macOS Tahoe older than 26.7.1 or macOS Sequoia older than 15.8.1, or if your iPhone or iPad runs iOS 26 older than 26.7.1 or iOS 18 older than 18.7.11. If you installed the October 26 updates you are covered.",
   "action": "Update your Mac (Tahoe 26.7.1 / Sequoia 15.8.1 or newer) and your iPhone or iPad (iOS 26.7.1 / 18.7.11 or newer)",
   "affected": [
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Tahoe before 26.7.1; macOS Sequoia before 15.8.1",
     "fixed_version": "26.7.1 (Tahoe) / 15.8.1 (Sequoia)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149228",
      "https://support.apple.com/en-us/149229"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "iphone-ios",
     "product_name": "iPhone and iPad (iOS)",
     "platform": "ios",
     "affected_versions": "iOS and iPadOS 26 before 26.7.1; iOS and iPadOS 18 before 18.7.11 (older iPhones such as iPhone XS and XR)",
     "fixed_version": "26.7.1 / 18.7.11",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149226",
      "https://support.apple.com/en-us/149225"
     ],
     "check": {
      "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://support.apple.com/en-us/100100"
    }
   ],
   "fix_steps": [
    "On a Mac: click the Apple menu > System Settings > General > Software Update, then click Update Now.",
    "On an iPhone or iPad: open Settings > General > Software Update and install the newest version.",
    "Restart when asked."
   ],
   "official_patch_links": [
    {
     "label": "Apple: how to update your Mac",
     "url": "https://support.apple.com/en-us/108382"
    },
    {
     "label": "Apple: how to update your iPhone or iPad",
     "url": "https://support.apple.com/en-us/118575"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/149228",
     "title": "Apple: About the security content of macOS Tahoe 26.7.1",
     "date": "2026-09-28",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149229",
     "title": "Apple: About the security content of macOS Sequoia 15.8.1",
     "date": "2026-09-28",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities entry for CVE-2026-86950",
     "date": "2026-09-29",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86950",
     "title": "NVD: CVE-2026-86950",
     "date": "2026-09-28",
     "kind": "nvd",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149226",
     "title": "Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1",
     "date": "2026-09-28",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149225",
     "title": "Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    }
   ]
  },
  {
   "id": "macos-screen-sharing-attacked-bug-aug-2026",
   "url": "https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026/",
   "path": "/incidents/macos-screen-sharing-attacked-bug-aug-2026/",
   "json_url": "https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026.json",
   "title": "Mac: a Screen Sharing bug let attackers on the network get in without a password",
   "category": "mac",
   "platforms": [
    "macos"
   ],
   "products": [
    "macos"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists it as used in real attacks (added Aug 18, 2026).",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-08-06",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-65400"
   ],
   "summary": "If Screen Sharing is turned on, a bug let someone on the same network connect to your Mac without the right password. Apple fixed it on August 6, 2026. Most home users have Screen Sharing turned off.",
   "am_i_affected": "You are at risk if Screen Sharing is on and your Mac runs macOS Tahoe older than 26.6.1, Sequoia older than 15.7.9 or Sonoma older than 14.8.9. Check System Settings > General > Sharing.",
   "action": "Update macOS (Aug 2026 update or newer)",
   "affected": [
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Tahoe before 26.6.1, Sequoia before 15.7.9, Sonoma before 14.8.9",
     "fixed_version": "26.6.1 (Tahoe) / 15.7.9 (Sequoia) / 14.8.9 (Sonoma)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/148170",
      "https://support.apple.com/en-us/148171",
      "https://support.apple.com/en-us/148172"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    }
   ],
   "fix_steps": [
    "Click the Apple menu > System Settings > General > Software Update.",
    "Install the update it offers.",
    "Restart your Mac when asked.",
    "If you do not use it, turn off Screen Sharing in System Settings > General > Sharing."
   ],
   "official_patch_links": [
    {
     "label": "Apple: update macOS on your Mac",
     "url": "https://support.apple.com/en-us/108382"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/148170",
     "title": "Apple: About the security content of macOS Tahoe 26.6.1",
     "date": "2026-08-06",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/148171",
     "title": "Apple: About the security content of macOS Sequoia 15.7.9",
     "date": "2026-08-06",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/148172",
     "title": "Apple: About the security content of macOS Sonoma 14.8.9",
     "date": "2026-08-06",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-65400 (added 2026-08-18)",
     "date": "2026-08-18",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65400",
     "title": "NVD: CVE-2026-65400",
     "date": "2026-08-06",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "apple-attacked-bug-feb-2026",
   "url": "https://patchgap.ai/incidents/apple-attacked-bug-feb-2026/",
   "path": "/incidents/apple-attacked-bug-feb-2026/",
   "json_url": "https://patchgap.ai/incidents/apple-attacked-bug-feb-2026.json",
   "title": "Mac and iPhone: a core system bug was used in targeted attacks",
   "category": "mac",
   "platforms": [
    "macos",
    "ios"
   ],
   "products": [
    "macos",
    "iphone-ios"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "Apple says it may have been used in an extremely sophisticated attack against specific people. CISA lists it as used in real attacks (added Feb 12, 2026).",
   "exploited_source_url": "https://support.apple.com/en-us/126348",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-02-11",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-20700"
   ],
   "summary": "A bug in a core part of Apple's systems let attackers who already had a foothold run their own code. Apple says it was used against specific people. Apple fixed it in macOS Tahoe 26.3 and iOS 26.3.",
   "am_i_affected": "You are at risk if your Mac runs macOS Tahoe older than 26.3 or your iPhone runs iOS 26 older than 26.3.",
   "action": "Update macOS and iPhone (26.3 or newer)",
   "affected": [
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Tahoe before 26.3",
     "fixed_version": "26.3 (Tahoe)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/126348"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "iphone-ios",
     "product_name": "iPhone and iPad (iOS)",
     "platform": "ios",
     "affected_versions": "iOS and iPadOS 26 before 26.3",
     "fixed_version": "iOS 26.3",
     "fixed_min": "26.3",
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/126346"
     ],
     "check": {
      "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://support.apple.com/en-us/100100"
    }
   ],
   "fix_steps": [
    "Click the Apple menu > System Settings > General > Software Update.",
    "Install the update it offers.",
    "Restart your Mac when asked.",
    "On iPhone or iPad: Settings > General > Software Update."
   ],
   "official_patch_links": [
    {
     "label": "Apple: update macOS on your Mac",
     "url": "https://support.apple.com/en-us/108382"
    },
    {
     "label": "Apple: update your iPhone or iPad",
     "url": "https://support.apple.com/en-us/100100"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/126348",
     "title": "Apple: About the security content of macOS Tahoe 26.3",
     "date": "2026-02-11",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/126346",
     "title": "Apple: About the security content of iOS 26.3 and iPadOS 26.3",
     "date": "2026-02-11",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-20700 (added 2026-02-12)",
     "date": "2026-02-12",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20700",
     "title": "NVD: CVE-2026-20700",
     "date": "2026-02-11",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "apple-webkit-attacked-bug-dec-2025",
   "url": "https://patchgap.ai/incidents/apple-webkit-attacked-bug-dec-2025/",
   "path": "/incidents/apple-webkit-attacked-bug-dec-2025/",
   "json_url": "https://patchgap.ai/incidents/apple-webkit-attacked-bug-dec-2025.json",
   "title": "Safari, Mac and iPhone: a web page bug was used in targeted attacks",
   "category": "mac",
   "platforms": [
    "macos",
    "ios"
   ],
   "products": [
    "macos",
    "safari",
    "iphone-ios"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "Apple says it may have been used in an extremely sophisticated attack against specific people. CISA lists it as used in real attacks (added Dec 15, 2025).",
   "exploited_source_url": "https://support.apple.com/en-us/125886",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2025-12-12",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-43529",
    "CVE-2025-14174"
   ],
   "summary": "A bug in WebKit, the engine that shows web pages in Safari and every iPhone browser, let a booby-trapped web page run code on the device. Apple says it was used against specific people. Apple fixed it on December 12, 2025.",
   "am_i_affected": "You are at risk if your Mac runs macOS Tahoe older than 26.2 and Safari older than 26.2, or your iPhone runs iOS 26 older than 26.2.",
   "action": "Update macOS, Safari and iPhone (26.2 or newer)",
   "affected": [
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Tahoe before 26.2",
     "fixed_version": "26.2 (Tahoe)",
     "fixed_min": null,
     "fix_note": "On older macOS (Sequoia, Sonoma), installing Safari 26.2 fixes it.",
     "fixed_source_urls": [
      "https://support.apple.com/en-us/125886",
      "https://support.apple.com/en-us/125892"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "safari",
     "product_name": "Safari",
     "platform": "macos",
     "affected_versions": "Safari before 26.2",
     "fixed_version": "26.2",
     "fixed_min": "26.2",
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/125892"
     ],
     "check": {
      "menu_path": "Open Safari. Menu bar: Safari > About Safari.",
      "command": "mdls -name kMDItemVersion \"/Applications/Safari.app\"",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "iphone-ios",
     "product_name": "iPhone and iPad (iOS)",
     "platform": "ios",
     "affected_versions": "iOS and iPadOS 26 before 26.2",
     "fixed_version": "iOS 26.2",
     "fixed_min": "26.2",
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/125884"
     ],
     "check": {
      "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://support.apple.com/en-us/100100"
    }
   ],
   "fix_steps": [
    "Click the Apple menu > System Settings > General > Software Update.",
    "Install the update it offers.",
    "Restart your Mac when asked.",
    "On iPhone or iPad: Settings > General > Software Update."
   ],
   "official_patch_links": [
    {
     "label": "Apple: update macOS on your Mac",
     "url": "https://support.apple.com/en-us/108382"
    },
    {
     "label": "Apple: update your iPhone or iPad",
     "url": "https://support.apple.com/en-us/100100"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/125886",
     "title": "Apple: About the security content of macOS Tahoe 26.2",
     "date": "2025-12-12",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/125892",
     "title": "Apple: About the security content of Safari 26.2",
     "date": "2025-12-12",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/125884",
     "title": "Apple: About the security content of iOS 26.2 and iPadOS 26.2",
     "date": "2025-12-12",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-43529 (added 2025-12-15)",
     "date": "2025-12-15",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43529",
     "title": "NVD: CVE-2025-43529",
     "date": "2025-12-12",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "apple-attacked-bugs-nov-2025",
   "url": "https://patchgap.ai/incidents/apple-attacked-bugs-nov-2025/",
   "path": "/incidents/apple-attacked-bugs-nov-2025/",
   "json_url": "https://patchgap.ai/incidents/apple-attacked-bugs-nov-2025.json",
   "title": "Mac, iPhone and iPad: two bugs fixed in November 2025 were later found in real attacks",
   "category": "mac",
   "platforms": [
    "macos",
    "ios"
   ],
   "products": [
    "macos",
    "iphone-ios"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA added both to its list of bugs used in real attacks on Mar 20, 2026.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2025-11-03",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-43510",
    "CVE-2025-43520"
   ],
   "summary": "Two bugs in the core of Apple's systems let a bad app take more control of a Mac, iPhone or iPad. Apple fixed them in November 2025. In March 2026 the US government said attackers were using them.",
   "am_i_affected": "You are at risk if your Mac runs macOS Tahoe older than 26.1, Sequoia older than 15.7.2 or Sonoma older than 14.8.2, or your iPhone runs iOS 26 older than 26.1.",
   "action": "Update your Mac and iPhone (Nov 2025 updates or newer)",
   "affected": [
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Tahoe before 26.1, Sequoia before 15.7.2, Sonoma before 14.8.2",
     "fixed_version": "26.1 (Tahoe) / 15.7.2 (Sequoia) / 14.8.2 (Sonoma)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/125634",
      "https://support.apple.com/en-us/125635",
      "https://support.apple.com/en-us/125636"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "iphone-ios",
     "product_name": "iPhone and iPad (iOS)",
     "platform": "ios",
     "affected_versions": "iOS and iPadOS 26 before 26.1",
     "fixed_version": "iOS 26.1",
     "fixed_min": "26.1",
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/125632"
     ],
     "check": {
      "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://support.apple.com/en-us/100100"
    }
   ],
   "fix_steps": [
    "Click the Apple menu > System Settings > General > Software Update.",
    "Install the update it offers.",
    "Restart your Mac when asked.",
    "On iPhone or iPad: Settings > General > Software Update."
   ],
   "official_patch_links": [
    {
     "label": "Apple: update macOS on your Mac",
     "url": "https://support.apple.com/en-us/108382"
    },
    {
     "label": "Apple: update your iPhone or iPad",
     "url": "https://support.apple.com/en-us/100100"
    },
    {
     "label": "Apple security releases",
     "url": "https://support.apple.com/en-us/100100"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/125634",
     "title": "Apple: About the security content of macOS Tahoe 26.1",
     "date": "2025-11-03",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/125635",
     "title": "Apple: About the security content of macOS Sequoia 15.7.2",
     "date": "2025-11-03",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/125636",
     "title": "Apple: About the security content of macOS Sonoma 14.8.2",
     "date": "2025-11-03",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/125632",
     "title": "Apple: About the security content of iOS 26.1 and iPadOS 26.1",
     "date": "2025-11-03",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-43510, CVE-2025-43520 (added 2026-03-20)",
     "date": "2026-03-20",
     "kind": "cisa",
     "official": true
    }
   ]
  },
  {
   "id": "apple-webkit-pointer-auth-cve-2024-27834",
   "url": "https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834/",
   "path": "/incidents/apple-webkit-pointer-auth-cve-2024-27834/",
   "json_url": "https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834.json",
   "title": "Mac, Safari, and iPhone: CISA says an old Apple bug is being used in real attacks. Update if you missed May 2024 fixes.",
   "category": "browsers",
   "platforms": [
    "macos",
    "ios"
   ],
   "products": [
    "safari",
    "macos",
    "iphone-ios"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists it as used in real attacks (added Nov 4, 2026).",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2024-05-13",
   "updated_at": "2026-11-04",
   "cves": [
    "CVE-2024-27834"
   ],
   "summary": "Apple fixed a browser engine bug in May 2024. On November 4, 2026, CISA said that bug is being used in real attacks. If you installed Apple updates from May 2024 or later, you already have the fix. This mainly matters for a Mac, iPhone, or iPad that has not updated since before mid-May 2024.",
   "am_i_affected": "You are at risk only if your device never got the May 2024 updates: Safari older than 17.5, macOS Sonoma older than 14.5 (or Ventura older than 13.6.7, Monterey older than 12.7.5), or iPhone/iPad older than iOS 17.5 / 16.7.8. On a Mac check Apple menu > About This Mac and Safari > About Safari. On an iPhone go to Settings > General > About.",
   "action": "Install any Apple update from May 2024 or later (most people already did)",
   "affected": [
    {
     "product": "safari",
     "product_name": "Safari",
     "platform": "macos",
     "affected_versions": "Safari before 17.5 (on macOS Monterey and Ventura standalone Safari updates)",
     "fixed_version": "Safari 17.5",
     "fixed_min": "17.5",
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/120896"
     ],
     "check": {
      "menu_path": "Open Safari. Menu bar: Safari > About Safari.",
      "command": "mdls -name kMDItemVersion \"/Applications/Safari.app\"",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Sonoma before 14.5; Ventura before 13.6.7; Monterey before 12.7.5",
     "fixed_version": "14.5 (Sonoma) / 13.6.7 (Ventura) / 12.7.5 (Monterey)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/120903",
      "https://support.apple.com/en-us/120900",
      "https://support.apple.com/en-us/120899"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "iphone-ios",
     "product_name": "iPhone and iPad (iOS)",
     "platform": "ios",
     "affected_versions": "iOS/iPadOS before 17.5, and older devices before 16.7.8",
     "fixed_version": "iOS/iPadOS 17.5 or 16.7.8",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/120905",
      "https://support.apple.com/en-us/120898"
     ],
     "check": {
      "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://support.apple.com/en-us/100100"
    }
   ],
   "fix_steps": [
    "On a Mac: Apple menu > System Settings > General > Software Update, then install what it offers and restart if asked.",
    "On an iPhone or iPad: Settings > General > Software Update, then install what it offers.",
    "If Safari updates on its own for older Macs: open Software Update the same way, or open Safari > About Safari after updating."
   ],
   "official_patch_links": [
    {
     "label": "Apple: update macOS on your Mac",
     "url": "https://support.apple.com/en-us/108382"
    },
    {
     "label": "Apple: update your iPhone or iPad",
     "url": "https://support.apple.com/en-us/100100"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/120896",
     "title": "Apple: About the security content of Safari 17.5",
     "date": "2024-05-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/120903",
     "title": "Apple: About the security content of macOS Sonoma 14.5",
     "date": "2024-05-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/120900",
     "title": "Apple: About the security content of macOS Ventura 13.6.7",
     "date": "2024-05-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/120899",
     "title": "Apple: About the security content of macOS Monterey 12.7.5",
     "date": "2024-05-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/120905",
     "title": "Apple: About the security content of iOS 17.5 and iPadOS 17.5",
     "date": "2024-05-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/120898",
     "title": "Apple: About the security content of iOS 16.7.8 and iPadOS 16.7.8",
     "date": "2024-05-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2024-27834 (added 2026-11-04)",
     "date": "2026-11-04",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog",
     "title": "CISA alert: Adds One Known Exploited Vulnerability to Catalog (CVE-2024-27834)",
     "date": "2026-11-04",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27834",
     "title": "NVD: CVE-2024-27834",
     "date": "2024-05-14",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "macos-27-2-security-updates-oct-26",
   "url": "https://patchgap.ai/incidents/macos-27-2-security-updates-oct-26/",
   "path": "/incidents/macos-27-2-security-updates-oct-26/",
   "json_url": "https://patchgap.ai/incidents/macos-27-2-security-updates-oct-26.json",
   "title": "Mac: macOS and Safari updates out today fix hundreds of security bugs",
   "category": "mac",
   "platforms": [
    "macos"
   ],
   "products": [
    "macos",
    "safari"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Apple lists 262, 213 and 197 fixed bugs in the three macOS updates (no single score).",
   "exploited_in_wild": "unknown",
   "exploited_note": "Apple's notes for these updates do not say any of the bugs are being attacked.",
   "exploited_source_url": "https://support.apple.com/en-us/149521",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-26",
   "updated_at": "2026-10-27",
   "cves": [],
   "summary": "On October 26, 2026 Apple released new versions for Macs: macOS Golden Gate 27.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2, plus Safari 27.2. Together they fix hundreds of security bugs, such as ones where a bad picture or web page could crash an app or harm your Mac. Install the update that matches your Mac.",
   "am_i_affected": "You are at risk if your Mac is on an older version than the ones below. Click the Apple menu > About This Mac to see your version.",
   "action": "Update your Mac and Safari (Oct 26 updates)",
   "affected": [
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "macOS Golden Gate before 27.2; macOS Tahoe before 26.7.2; macOS Sequoia before 15.8.2",
     "fixed_version": "27.2 (Golden Gate) / 26.7.2 (Tahoe) / 15.8.2 (Sequoia)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149521",
      "https://support.apple.com/en-us/149522",
      "https://support.apple.com/en-us/149523"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "safari",
     "product_name": "Safari",
     "platform": "macos",
     "affected_versions": "Safari before 27.2 on macOS Sequoia and macOS Tahoe",
     "fixed_version": "27.2",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149527"
     ],
     "check": {
      "menu_path": "Open Safari. Menu bar: Safari > About Safari.",
      "command": "mdls -name kMDItemVersion \"/Applications/Safari.app\"",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    }
   ],
   "fix_steps": [
    "Click the Apple menu > System Settings > General > Software Update.",
    "Click Update Now (or Upgrade Now if it offers a new macOS).",
    "Wait for the download and install. Your Mac will restart.",
    "Open Safari afterwards and check Safari > About Safari shows 27.2 on Sequoia or Tahoe."
   ],
   "official_patch_links": [
    {
     "label": "Apple: how to update your Mac",
     "url": "https://support.apple.com/en-us/108382"
    },
    {
     "label": "Apple security releases",
     "url": "https://support.apple.com/en-us/100100"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://support.apple.com/en-us/149521",
     "title": "Apple: About the security content of macOS Golden Gate 27.2",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149522",
     "title": "Apple: About the security content of macOS Tahoe 26.7.2",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149523",
     "title": "Apple: About the security content of macOS Sequoia 15.8.2",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149527",
     "title": "Apple: About the security content of Safari 27.2",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/100100",
     "title": "Apple: security releases list",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    }
   ]
  },
  {
   "id": "emudhra-fake-website-certificates",
   "url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates/",
   "path": "/incidents/emudhra-fake-website-certificates/",
   "json_url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates.json",
   "title": "Fake website certificates: browsers and computers are blocking a certificate company's weak keys",
   "category": "browsers",
   "platforms": [
    "windows",
    "macos",
    "linux"
   ],
   "products": [
    "chrome",
    "firefox",
    "edge",
    "windows",
    "macos",
    "tailscale"
   ],
   "status": "partial",
   "status_label": "Partly patched",
   "severity": "high",
   "severity_source": "Mozilla and Google both treat it as a serious break in website trust. No score exists.",
   "exploited_in_wild": "no",
   "exploited_note": "Google says no fake certificates were found in public records before it blocked the keys. The company (eMudhra) says it issued no certificates from those keys.",
   "exploited_source_url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-17",
   "updated_at": "2026-10-27",
   "cves": [],
   "summary": "When you visit a secure website, your browser trusts a 'certificate' to prove the site is real. A company called eMudhra made weak secret keys for 8 of its certificate makers. Someone could use them to make fake certificates and pretend to be any website. Mozilla, Google, Apple and Microsoft all blocked those keys in the days after Oct 17. Most of this is automatic. Make sure your browser and your computer are up to date.",
   "am_i_affected": "Most people are already protected because the block went out by itself within hours. Browsers and computers that were offline, or had special settings, may be behind. Update your browser and your computer to be sure. Mac command-line tools still need a future Apple update.",
   "action": "Update your browsers, Windows, Mac and Tailscale",
   "affected": [
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "windows",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Click the three lines at the top right > Help > About Firefox. Firefox checks for updates there.",
      "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Mozilla Firefox*' | Select-Object DisplayName,DisplayVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "macos",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Firefox menu bar: Firefox > About Firefox.",
      "command": "defaults read \"/Applications/Firefox.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "linux",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Firefox menu > Help > About Firefox.",
      "command": "firefox --version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "windows",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Click the three dots at the top right > Help > About Google Chrome. Chrome checks for updates there, then click Relaunch.",
      "command": "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "macos",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Chrome menu bar: Chrome > About Google Chrome.",
      "command": "defaults read \"/Applications/Google Chrome.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "linux",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Chrome menu: three dots > Help > About Google Chrome.",
      "command": "google-chrome --version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "edge",
     "product_name": "Microsoft Edge",
     "platform": "windows",
     "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Click the three dots at the top right > Help and feedback > About Microsoft Edge.",
      "command": "(Get-Item \"${env:ProgramFiles(x86)}\\Microsoft\\Edge\\Application\\msedge.exe\" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.microsoft.com/edge/download"
    },
    {
     "product": "edge",
     "product_name": "Microsoft Edge",
     "platform": "macos",
     "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Edge menu bar: Microsoft Edge > About Microsoft Edge.",
      "command": "defaults read \"/Applications/Microsoft Edge.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.microsoft.com/edge/download"
    },
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows without Microsoft's Oct 26, 2026 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft released an out-of-band Windows update on Oct 26, 2026 that removes seven affected certificates.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "Mac command-line tools (not Safari or other apps)",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Apple blocked the certificates automatically from Oct 19, 2026 (and the root on Oct 23). A future macOS update will block them in command-line tools too.",
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149555"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "windows",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
      "command": "tailscale version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "macos",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
      "command": "tailscale version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "linux",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://tailscale.com/download"
    }
   ],
   "fix_steps": [
    "Update your browser: Chrome (three dots > Help > About Google Chrome), Firefox (three lines > Help > About Firefox), Edge (three dots > Help and feedback > About Microsoft Edge).",
    "Run Windows Update (Settings > Windows Update) and install everything, including the update from Oct 26.",
    "On a Mac, run Software Update (System Settings > General > Software Update).",
    "If you use Tailscale, update it to the newest version.",
    "A site that suddenly shows a certificate warning might use the blocked company. That is expected. Do not click through the warning. Tell the site owner."
   ],
   "official_patch_links": [
    {
     "label": "Mozilla: blog post about the eMudhra block",
     "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
    },
    {
     "label": "Apple: about the compromised eMudhra certificates",
     "url": "https://support.apple.com/en-us/149555"
    },
    {
     "label": "Microsoft: response to the eMudhra keys",
     "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/",
     "title": "Mozilla Security Blog: Protecting Firefox users after the eMudhra compromise",
     "date": "2026-10-20",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
     "title": "Google: Protecting Chrome and Android users from compromised eMudhra certificates",
     "date": "2026-10-20",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149555",
     "title": "Apple Support: About the compromised eMudhra intermediate CAs",
     "date": "2026-10-23",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys",
     "title": "Microsoft MSRC: Response to compromised eMudhra keys",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://tailscale.com/changelog",
     "title": "Tailscale changelog (Oct 21, 2026 entry)",
     "date": "2026-10-21",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://emudhra.com/en/post/certificate-security-incident",
     "title": "eMudhra: Statement on the certificate security incident",
     "date": "2026-10-21",
     "kind": "primary",
     "official": true
    },
    {
     "url": "https://tailscale.com/security-bulletins",
     "title": "Tailscale security bulletin TS-2026-013 (eMudhra certificates)",
     "date": "2026-10-21",
     "kind": "vendor",
     "official": true
    }
   ]
  }
 ]
}