{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "tailscale",
  "name": "Tailscale",
  "short_name": "Tailscale",
  "page_url": "https://patchgap.ai/is-my-tailscale-up-to-date/",
  "minimum_safe_version": "1.104.4",
  "minimum_safe_version_source": [
   {
    "url": "https://tailscale.com/security-bulletins",
    "title": "Tailscale security bulletins TS-2026-014 to TS-2026-017 (fixed in 1.104.4)",
    "date": "2026-10-27",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": "1.104.4",
   "applies_to": "all platforms listed for this product",
   "source_incident": "tailscale-ssh-flaws-tailworm",
   "sources": [
    {
     "url": "https://tailscale.com/security-bulletins",
     "title": "Tailscale security bulletins TS-2026-014 to TS-2026-017 (fixed in 1.104.4)",
     "date": "2026-10-27",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": false,
   "caveats": [
    "Only partly fixed so far, so also follow the extra steps on their pages: emudhra-fake-website-certificates."
   ],
   "text": "You're covered against every problem here that has a version number if you're on Tailscale 1.104.4 or newer."
  },
  "update_steps": {
   "windows": [
    "Download the newest version from tailscale.com/download, or use the app's update option if auto-update is on."
   ],
   "macos": [
    "Download the newest version from tailscale.com/download, or use the app's update option if auto-update is on."
   ],
   "linux": [
    "Download the newest version from tailscale.com/download, or use the app's update option if auto-update is on."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Tailscale",
  "category": "network",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "what_it_is": "A VPN-style app that links your devices into one private network.",
  "url": "https://patchgap.ai/is-my-tailscale-up-to-date/",
  "json_url": "https://patchgap.ai/products/tailscale.json",
  "official_site": "https://tailscale.com",
  "official_download": "https://tailscale.com/download",
  "how_it_updates": "Tailscale can update itself if auto-update is on. Or download the newest version from the official site.",
  "check": {
   "windows": {
    "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
    "command": "tailscale version",
    "shell": "PowerShell",
    "read_only": true
   },
   "macos": {
    "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
    "command": "tailscale version",
    "shell": "Terminal",
    "read_only": true
   },
   "linux": {
    "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
    "command": null,
    "shell": null,
    "read_only": null
   }
  },
  "open_incidents": [
   "tailscale-ssh-flaws-tailworm",
   "emudhra-fake-website-certificates"
  ]
 },
 "incidents": [
  {
   "id": "tailscale-ssh-flaws-tailworm",
   "url": "https://patchgap.ai/incidents/tailscale-ssh-flaws-tailworm/",
   "path": "/incidents/tailscale-ssh-flaws-tailworm/",
   "json_url": "https://patchgap.ai/incidents/tailscale-ssh-flaws-tailworm.json",
   "title": "Tailscale SSH: serious bugs are now fixed in Tailscale 1.104.4. Update now.",
   "category": "network",
   "platforms": [
    "windows",
    "macos",
    "linux"
   ],
   "products": [
    "tailscale"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Tailscale calls them 'serious security issues'. No score published.",
   "exploited_in_wild": "unknown",
   "exploited_note": "Tailscale's notices do not say anyone is using these bugs.",
   "exploited_source_url": "https://tailscale.com/ssh-investigation-update",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-25",
   "updated_at": "2026-10-28",
   "cves": [],
   "summary": "A researcher published bugs in Tailscale SSH, a feature of the Tailscale app. Some people who are already allowed to connect could get more power than they should. Tailscale fixed these bugs in version 1.104.4 and posted four notices about them (TS-2026-014 to TS-2026-017). Update Tailscale to 1.104.4 or newer.",
   "am_i_affected": "This is mostly about the Tailscale SSH and Tailscale Serve features. If you never turned them on, this probably does not apply to you. Still, update Tailscale to 1.104.4 or newer to be safe.",
   "action": "Update Tailscale to 1.104.4 or newer",
   "affected": [
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "windows",
     "affected_versions": "Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve)",
     "fixed_version": "1.104.4",
     "fixed_min": "1.104.4",
     "fix_note": null,
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
      "command": "tailscale version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "macos",
     "affected_versions": "Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve)",
     "fixed_version": "1.104.4",
     "fixed_min": "1.104.4",
     "fix_note": null,
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
      "command": "tailscale version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "linux",
     "affected_versions": "Tailscale older than 1.104.4 (mainly if you use Tailscale SSH or Serve)",
     "fixed_version": "1.104.4",
     "fixed_min": "1.104.4",
     "fix_note": null,
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins"
     ],
     "check": {
      "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://tailscale.com/download"
    }
   ],
   "fix_steps": [
    "Update Tailscale to version 1.104.4 or newer (the Tailscale icon > check for updates, or download it from the official site).",
    "If you use Tailscale SSH: limit who can connect to only the people and devices that need it."
   ],
   "official_patch_links": [
    {
     "label": "Tailscale: security bulletins",
     "url": "https://tailscale.com/security-bulletins"
    },
    {
     "label": "Tailscale: official download",
     "url": "https://tailscale.com/download"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://tailscale.com/ssh-investigation-update",
     "title": "Tailscale: SSH investigation and remediation update",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://tailscale.com/security-bulletins",
     "title": "Tailscale security bulletins TS-2026-014 to TS-2026-017 (fixed in 1.104.4)",
     "date": "2026-10-27",
     "kind": "vendor",
     "official": true
    }
   ]
  },
  {
   "id": "emudhra-fake-website-certificates",
   "url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates/",
   "path": "/incidents/emudhra-fake-website-certificates/",
   "json_url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates.json",
   "title": "Fake website certificates: browsers and computers are blocking a certificate company's weak keys",
   "category": "browsers",
   "platforms": [
    "windows",
    "macos",
    "linux"
   ],
   "products": [
    "chrome",
    "firefox",
    "edge",
    "windows",
    "macos",
    "tailscale"
   ],
   "status": "partial",
   "status_label": "Partly patched",
   "severity": "high",
   "severity_source": "Mozilla and Google both treat it as a serious break in website trust. No score exists.",
   "exploited_in_wild": "no",
   "exploited_note": "Google says no fake certificates were found in public records before it blocked the keys. The company (eMudhra) says it issued no certificates from those keys.",
   "exploited_source_url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-17",
   "updated_at": "2026-10-27",
   "cves": [],
   "summary": "When you visit a secure website, your browser trusts a 'certificate' to prove the site is real. A company called eMudhra made weak secret keys for 8 of its certificate makers. Someone could use them to make fake certificates and pretend to be any website. Mozilla, Google, Apple and Microsoft all blocked those keys in the days after Oct 17. Most of this is automatic. Make sure your browser and your computer are up to date.",
   "am_i_affected": "Most people are already protected because the block went out by itself within hours. Browsers and computers that were offline, or had special settings, may be behind. Update your browser and your computer to be sure. Mac command-line tools still need a future Apple update.",
   "action": "Update your browsers, Windows, Mac and Tailscale",
   "affected": [
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "windows",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Click the three lines at the top right > Help > About Firefox. Firefox checks for updates there.",
      "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Mozilla Firefox*' | Select-Object DisplayName,DisplayVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "macos",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Firefox menu bar: Firefox > About Firefox.",
      "command": "defaults read \"/Applications/Firefox.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "linux",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Firefox menu > Help > About Firefox.",
      "command": "firefox --version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "windows",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Click the three dots at the top right > Help > About Google Chrome. Chrome checks for updates there, then click Relaunch.",
      "command": "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "macos",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Chrome menu bar: Chrome > About Google Chrome.",
      "command": "defaults read \"/Applications/Google Chrome.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "linux",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Chrome menu: three dots > Help > About Google Chrome.",
      "command": "google-chrome --version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "edge",
     "product_name": "Microsoft Edge",
     "platform": "windows",
     "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Click the three dots at the top right > Help and feedback > About Microsoft Edge.",
      "command": "(Get-Item \"${env:ProgramFiles(x86)}\\Microsoft\\Edge\\Application\\msedge.exe\" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.microsoft.com/edge/download"
    },
    {
     "product": "edge",
     "product_name": "Microsoft Edge",
     "platform": "macos",
     "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Edge menu bar: Microsoft Edge > About Microsoft Edge.",
      "command": "defaults read \"/Applications/Microsoft Edge.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.microsoft.com/edge/download"
    },
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows without Microsoft's Oct 26, 2026 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft released an out-of-band Windows update on Oct 26, 2026 that removes seven affected certificates.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "Mac command-line tools (not Safari or other apps)",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Apple blocked the certificates automatically from Oct 19, 2026 (and the root on Oct 23). A future macOS update will block them in command-line tools too.",
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149555"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "windows",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
      "command": "tailscale version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "macos",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
      "command": "tailscale version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "linux",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://tailscale.com/download"
    }
   ],
   "fix_steps": [
    "Update your browser: Chrome (three dots > Help > About Google Chrome), Firefox (three lines > Help > About Firefox), Edge (three dots > Help and feedback > About Microsoft Edge).",
    "Run Windows Update (Settings > Windows Update) and install everything, including the update from Oct 26.",
    "On a Mac, run Software Update (System Settings > General > Software Update).",
    "If you use Tailscale, update it to the newest version.",
    "A site that suddenly shows a certificate warning might use the blocked company. That is expected. Do not click through the warning. Tell the site owner."
   ],
   "official_patch_links": [
    {
     "label": "Mozilla: blog post about the eMudhra block",
     "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
    },
    {
     "label": "Apple: about the compromised eMudhra certificates",
     "url": "https://support.apple.com/en-us/149555"
    },
    {
     "label": "Microsoft: response to the eMudhra keys",
     "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/",
     "title": "Mozilla Security Blog: Protecting Firefox users after the eMudhra compromise",
     "date": "2026-10-20",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
     "title": "Google: Protecting Chrome and Android users from compromised eMudhra certificates",
     "date": "2026-10-20",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149555",
     "title": "Apple Support: About the compromised eMudhra intermediate CAs",
     "date": "2026-10-23",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys",
     "title": "Microsoft MSRC: Response to compromised eMudhra keys",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://tailscale.com/changelog",
     "title": "Tailscale changelog (Oct 21, 2026 entry)",
     "date": "2026-10-21",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://emudhra.com/en/post/certificate-security-incident",
     "title": "eMudhra: Statement on the certificate security incident",
     "date": "2026-10-21",
     "kind": "primary",
     "official": true
    },
    {
     "url": "https://tailscale.com/security-bulletins",
     "title": "Tailscale security bulletin TS-2026-013 (eMudhra certificates)",
     "date": "2026-10-21",
     "kind": "vendor",
     "official": true
    }
   ]
  }
 ]
}