{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "windows",
  "name": "Windows 10 and 11",
  "short_name": "Windows",
  "page_url": "https://patchgap.ai/is-my-windows-up-to-date/",
  "minimum_safe_version": null,
  "minimum_safe_version_source": [
   {
    "url": "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct",
    "title": "Microsoft: October 2026 Security Updates release notes",
    "date": "2026-10-13",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": null,
   "applies_to": null,
   "source_incident": "windows-shell-zero-day-oct-2026",
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct",
     "title": "Microsoft: October 2026 Security Updates release notes",
     "date": "2026-10-13",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": false,
   "newest_fix": "Fixed by the October 13, 2026 Windows security update (or any newer update). Microsoft's Update Guide lists the exact update for each Windows version.",
   "caveats": [
    "Only partly fixed so far, so also follow the extra steps on their pages: windows-secure-boot-blackx-bootkit, emudhra-fake-website-certificates.",
    "These are fixed by an update without one version number we can compare, so check their pages: emudhra-fake-website-certificates, microsoft-defender-attacked-bugs-2026, windows-attacked-bugs-apr-2026, windows-attacked-bugs-aug-2026, windows-attacked-bugs-dec-2025, windows-attacked-bugs-feb-2026, windows-attacked-bugs-jan-2026, windows-attacked-bugs-nov-2025, windows-attacked-bugs-oct-2025, windows-attacked-bugs-sep-2026, windows-secure-boot-blackx-bootkit, windows-shell-zero-day-oct-2026."
   ],
   "text": "There is no single version number for Windows. The newest fix listed here is: Fixed by the October 13, 2026 Windows security update (or any newer update). Microsoft's Update Guide lists the exact update for each Windows version. If you have that or anything newer, you're covered against the fixed problems listed here (see the notes below)."
  },
  "update_steps": {
   "windows": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates and install what it finds.",
    "Restart when asked."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Microsoft",
  "category": "windows",
  "platforms": [
   "windows"
  ],
  "what_it_is": "The operating system on most PCs and laptops.",
  "url": "https://patchgap.ai/is-my-windows-up-to-date/",
  "json_url": "https://patchgap.ai/products/windows.json",
  "official_site": "https://www.microsoft.com/windows",
  "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a",
  "how_it_updates": "Windows Update installs fixes by itself, but a restart is often needed.",
  "check": {
   "windows": {
    "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
    "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
    "shell": "PowerShell",
    "read_only": true
   }
  },
  "open_incidents": [
   "windows-shell-zero-day-oct-2026",
   "windows-attacked-bugs-sep-2026",
   "windows-attacked-bugs-aug-2026",
   "windows-attacked-bugs-apr-2026",
   "microsoft-defender-attacked-bugs-2026",
   "windows-attacked-bugs-feb-2026",
   "windows-attacked-bugs-jan-2026",
   "windows-attacked-bugs-dec-2025",
   "windows-attacked-bugs-nov-2025",
   "windows-attacked-bugs-oct-2025",
   "windows-secure-boot-blackx-bootkit",
   "emudhra-fake-website-certificates"
  ]
 },
 "incidents": [
  {
   "id": "windows-shell-zero-day-oct-2026",
   "url": "https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026/",
   "path": "/incidents/windows-shell-zero-day-oct-2026/",
   "json_url": "https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026.json",
   "title": "Windows: a bug that lets a bad file skip Windows' safety warnings is being used by hackers",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "NVD score 8.8 out of 10 (CVE-2026-96951)",
   "exploited_in_wild": "yes",
   "exploited_note": "Microsoft marks it as 'Exploitation Detected' and the US government's CISA lists it as used in real attacks (added Oct 13, 2026).",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-13",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-96951"
   ],
   "summary": "Windows normally shows a warning when you open a file you got from the internet or an email. A bug in Windows lets some bad files skip that warning. Hackers are already using this bug. Microsoft fixed it in its October 2026 update (Oct 13). You still have to install that update.",
   "am_i_affected": "You are at risk if your Windows computer has not installed the October 13, 2026 update or any update after it. Open Settings > Windows Update. If it says 'You're up to date' and Update history shows an update from October 2026 or later, you are covered.",
   "action": "Run Windows Update (October 2026 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows computers that have not installed Microsoft's October 13, 2026 security update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the October 13, 2026 Windows security update (or any newer update). Microsoft's Update Guide lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks.",
    "Until you have updated, do not open files from emails or chats you did not expect, even if they look normal."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft October 2026 update notes",
     "url": "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct",
     "title": "Microsoft: October 2026 Security Updates release notes",
     "date": "2026-10-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-96951",
     "date": "2026-10-13",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96951",
     "title": "NVD: CVE-2026-96951",
     "date": "2026-10-13",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-sep-2026",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-sep-2026/",
   "path": "/incidents/windows-attacked-bugs-sep-2026/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-sep-2026.json",
   "title": "Windows: bugs fixed in the September 2026 update were used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists these as used in real attacks (added 2026-09-08). Microsoft's Security Update Guide marks them as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-09-08",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-81963",
    "CVE-2026-85880"
   ],
   "summary": "Two bugs, one in Windows Update itself, let a program that is already on your PC take full control of it. Microsoft fixed it in the September 2026 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since September 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (September 2026 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the September 2026 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the September 2026 Windows security update (2026-09-08) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2026-81963 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963",
     "title": "Microsoft Security Update Guide: CVE-2026-81963 (September 2026 update)",
     "date": "2026-09-08",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880",
     "title": "Microsoft Security Update Guide: CVE-2026-85880 (September 2026 update)",
     "date": "2026-09-08",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-81963, CVE-2026-85880 (added 2026-09-08)",
     "date": "2026-09-08",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81963",
     "title": "NVD: CVE-2026-81963",
     "date": "2026-09-08",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-aug-2026",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-aug-2026/",
   "path": "/incidents/windows-attacked-bugs-aug-2026/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-aug-2026.json",
   "title": "Windows: a bug fixed in the August 2026 update was used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists this as used in real attacks (added 2026-08-11). Microsoft's Security Update Guide marks it as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-08-11",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-68820"
   ],
   "summary": "A bug in the part of Windows that handles network connections lets a program that is already on your PC take full control of it. Microsoft fixed it in the August 2026 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since August 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (August 2026 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the August 2026 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the August 2026 Windows security update (2026-08-11) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2026-68820 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820",
     "title": "Microsoft Security Update Guide: CVE-2026-68820 (August 2026 update)",
     "date": "2026-08-11",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-68820 (added 2026-08-11)",
     "date": "2026-08-11",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68820",
     "title": "NVD: CVE-2026-68820",
     "date": "2026-08-11",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-apr-2026",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026/",
   "path": "/incidents/windows-attacked-bugs-apr-2026/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-apr-2026.json",
   "title": "Windows: a bug fixed in the April 2026 update was used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists this as used in real attacks (added 2026-04-28). Microsoft's Security Update Guide marks it as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-04-14",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-32202"
   ],
   "summary": "A bug in Windows File Explorer lets a bad file or shared folder fool Windows. It can leak your Windows sign-in details to attackers. Microsoft fixed it in the April 2026 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since April 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (April 2026 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the April 2026 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the April 2026 Windows security update (2026-04-14) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2026-32202 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202",
     "title": "Microsoft Security Update Guide: CVE-2026-32202 (April 2026 update)",
     "date": "2026-04-14",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-32202 (added 2026-04-28)",
     "date": "2026-04-28",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32202",
     "title": "NVD: CVE-2026-32202",
     "date": "2026-04-14",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "microsoft-defender-attacked-bugs-2026",
   "url": "https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026/",
   "path": "/incidents/microsoft-defender-attacked-bugs-2026/",
   "json_url": "https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026.json",
   "title": "Windows: three bugs in Microsoft Defender, the built-in antivirus, were used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists all three as used in real attacks (added Apr 22 and May 20, 2026).",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-04-14",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-33825",
    "CVE-2026-41091",
    "CVE-2026-45498"
   ],
   "summary": "Microsoft Defender is the antivirus built into Windows. Three bugs in it let a bad program that is already on your PC take more control, or stop Defender from working. Microsoft fixed them in April and May 2026. Defender normally updates itself in the background.",
   "am_i_affected": "You are at risk only if Defender has not updated since May 2026. Open Windows Security > Virus & threat protection > Protection updates and click Check for updates. If it finds nothing new, you are covered.",
   "action": "Check for Defender updates in Windows Security",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Microsoft Defender on Windows 10 and 11 without the April and May 2026 Defender updates",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by Microsoft Defender updates released in April 2026 (CVE-2026-33825) and May 2026 (the other two). Defender installs these by itself; Microsoft's pages list the fixed Defender versions.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start and type Windows Security, then open it.",
    "Click Virus & threat protection.",
    "Under Virus & threat protection updates, click Protection updates.",
    "Click Check for updates.",
    "Also run Windows Update (Settings > Windows Update) and restart if asked."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2026-41091 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825",
     "title": "Microsoft Security Update Guide: CVE-2026-33825 (April 2026 update)",
     "date": "2026-04-14",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091",
     "title": "Microsoft Security Update Guide: CVE-2026-41091 (May 2026 update)",
     "date": "2026-05-12",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498",
     "title": "Microsoft Security Update Guide: CVE-2026-45498 (May 2026 update)",
     "date": "2026-05-12",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-33825 (added 2026-04-22)",
     "date": "2026-04-22",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-41091, CVE-2026-45498 (added 2026-05-20)",
     "date": "2026-05-20",
     "kind": "cisa",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-feb-2026",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-feb-2026/",
   "path": "/incidents/windows-attacked-bugs-feb-2026/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-feb-2026.json",
   "title": "Windows: bugs fixed in the February 2026 update were used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists these as used in real attacks (added 2026-02-10). Microsoft's Security Update Guide marks them as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-02-10",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-21510",
    "CVE-2026-21513",
    "CVE-2026-21519",
    "CVE-2026-21525",
    "CVE-2026-21533"
   ],
   "summary": "Five Windows bugs were being used by attackers at once. Two let a bad link or file skip the warning Windows normally shows. The others let a program that is already on your PC take more control or crash parts of Windows. Microsoft fixed it in the February 2026 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since February 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (February 2026 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the February 2026 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the February 2026 Windows security update (2026-02-10) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2026-21510 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510",
     "title": "Microsoft Security Update Guide: CVE-2026-21510 (February 2026 update)",
     "date": "2026-02-10",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513",
     "title": "Microsoft Security Update Guide: CVE-2026-21513 (February 2026 update)",
     "date": "2026-02-10",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519",
     "title": "Microsoft Security Update Guide: CVE-2026-21519 (February 2026 update)",
     "date": "2026-02-10",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525",
     "title": "Microsoft Security Update Guide: CVE-2026-21525 (February 2026 update)",
     "date": "2026-02-10",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533",
     "title": "Microsoft Security Update Guide: CVE-2026-21533 (February 2026 update)",
     "date": "2026-02-10",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-21510, CVE-2026-21513, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 (added 2026-02-10)",
     "date": "2026-02-10",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21510",
     "title": "NVD: CVE-2026-21510",
     "date": "2026-02-10",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-jan-2026",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-jan-2026/",
   "path": "/incidents/windows-attacked-bugs-jan-2026/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-jan-2026.json",
   "title": "Windows: a bug fixed in the January 2026 update was used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists this as used in real attacks (added 2026-01-13). Microsoft's Security Update Guide marks it as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-01-13",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-20805"
   ],
   "summary": "A bug in the part of Windows that draws windows on the screen lets a bad program read secret data from memory. Attackers use it as one step in a bigger attack. Microsoft fixed it in the January 2026 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since January 2026. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (January 2026 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the January 2026 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the January 2026 Windows security update (2026-01-13) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2026-20805 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805",
     "title": "Microsoft Security Update Guide: CVE-2026-20805 (January 2026 update)",
     "date": "2026-01-13",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-20805 (added 2026-01-13)",
     "date": "2026-01-13",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20805",
     "title": "NVD: CVE-2026-20805",
     "date": "2026-01-13",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-dec-2025",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025/",
   "path": "/incidents/windows-attacked-bugs-dec-2025/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025.json",
   "title": "Windows: a bug fixed in the December 2025 update was used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists this as used in real attacks (added 2025-12-09). Microsoft's Security Update Guide marks it as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2025-12-09",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-62221"
   ],
   "summary": "A bug in the part of Windows that handles cloud files (like OneDrive) lets a program that is already on your PC take full control of it. Microsoft fixed it in the December 2025 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since December 2025. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (December 2025 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the December 2025 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the December 2025 Windows security update (2025-12-09) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2025-62221 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221",
     "title": "Microsoft Security Update Guide: CVE-2025-62221 (December 2025 update)",
     "date": "2025-12-09",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-62221 (added 2025-12-09)",
     "date": "2025-12-09",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62221",
     "title": "NVD: CVE-2025-62221",
     "date": "2025-12-09",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-nov-2025",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-nov-2025/",
   "path": "/incidents/windows-attacked-bugs-nov-2025/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-nov-2025.json",
   "title": "Windows: bugs fixed in the November 2025 update were used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists both as used in real attacks (CVE-2025-62215 added Nov 12, 2025; CVE-2025-60710 added Apr 13, 2026). Microsoft's Security Update Guide marks them as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2025-11-11",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-62215",
    "CVE-2025-60710"
   ],
   "summary": "Two bugs in Windows let a program that is already on your PC give itself full control of the computer. Both were fixed in the November 2025 update. Microsoft fixed it in the November 2025 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since November 2025. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (November 2025 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the November 2025 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the November 2025 Windows security update (2025-11-11) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2025-62215 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215",
     "title": "Microsoft Security Update Guide: CVE-2025-62215 (November 2025 update)",
     "date": "2025-11-11",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710",
     "title": "Microsoft Security Update Guide: CVE-2025-60710 (November 2025 update)",
     "date": "2025-11-11",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-62215 (added 2025-11-12)",
     "date": "2025-11-12",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-60710 (added 2026-04-13)",
     "date": "2026-04-13",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62215",
     "title": "NVD: CVE-2025-62215",
     "date": "2025-11-11",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-attacked-bugs-oct-2025",
   "url": "https://patchgap.ai/incidents/windows-attacked-bugs-oct-2025/",
   "path": "/incidents/windows-attacked-bugs-oct-2025/",
   "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-oct-2025.json",
   "title": "Windows: bugs fixed in the October 2025 update were used in real attacks",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA lists these as used in real attacks (added 2025-10-14). Microsoft's Security Update Guide marks them as exploited.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2025-10-14",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-24990",
    "CVE-2025-59230"
   ],
   "summary": "Two bugs in Windows let a program that is already on your PC take full control of it. One is in an old modem driver that ships with Windows; Microsoft removed that driver in the October 2025 update. Microsoft fixed it in the October 2025 Windows update. Any newer monthly update also includes the fix.",
   "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since October 2025. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
   "action": "Run Windows Update (October 2025 update or newer)",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows 10 and 11 PCs without the October 2025 security update or a newer one",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Fixed by the October 2025 Windows security update (2025-10-14) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
     "fixed_source_urls": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990",
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "Open Start > Settings > Windows Update.",
    "Click Check for updates.",
    "Let the updates download and install.",
    "Restart your computer when it asks."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to update Windows",
     "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "label": "Microsoft: CVE-2025-24990 details",
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990",
     "title": "Microsoft Security Update Guide: CVE-2025-24990 (October 2025 update)",
     "date": "2025-10-14",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230",
     "title": "Microsoft Security Update Guide: CVE-2025-59230 (October 2025 update)",
     "date": "2025-10-14",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-24990, CVE-2025-59230 (added 2025-10-14)",
     "date": "2025-10-14",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24990",
     "title": "NVD: CVE-2025-24990",
     "date": "2025-10-14",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "windows-secure-boot-blackx-bootkit",
   "url": "https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit/",
   "path": "/incidents/windows-secure-boot-blackx-bootkit/",
   "json_url": "https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit.json",
   "title": "Windows: a hidden start-up virus (BlackX) works even on updated PCs, unless one extra step is done",
   "category": "windows",
   "platforms": [
    "windows"
   ],
   "products": [
    "windows"
   ],
   "status": "partial",
   "status_label": "Partly patched",
   "severity": "medium",
   "severity_source": "NVD score 4.4 for the old bug it uses (CVE-2022-21894). Real attacks so far hit government targets.",
   "exploited_in_wild": "yes",
   "exploited_note": "Kaspersky says it found BlackX used in a spying campaign against government offices in Central Asia in early 2026.",
   "exploited_source_url": "https://securelist.com/uefi-bootkit-blackx/121539/",
   "confidence": "unconfirmed",
   "confidence_note": "The attacks come from Kaspersky's research report. Microsoft has not published anything about BlackX itself. Microsoft's own guide confirms the extra step is off by default.",
   "first_reported": "2026-10-22",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2022-21894"
   ],
   "summary": "Secure Boot is a lock that checks your computer's start-up files. Researchers at Kaspersky found a virus called BlackX that gets past this lock. It uses an old bug that Microsoft fixed in 2023, but the fix is not fully switched on unless an extra step is done by hand. The attacks found so far hit government targets, so most home users are at low risk. Still, it is worth knowing about.",
   "am_i_affected": "Probably not a big risk for a home computer, but it could be if your PC uses Secure Boot and the extra Microsoft step was never done. A read-only check is below. Ask an IT helper before you change anything, because the wrong steps can stop old recovery drives from working.",
   "action": "Windows: install updates, then check the extra Secure Boot step",
   "affected": [
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows PCs with Secure Boot where Microsoft's extra 'revocation' step was never turned on",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft's protection is in updates from July 9, 2024 and later, but it is NOT turned on by default. You must turn it on by following Microsoft's guide.",
     "fixed_source_urls": [
      "https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    }
   ],
   "fix_steps": [
    "First install all Windows updates (Settings > Windows Update).",
    "Make a backup of your important files.",
    "Read Microsoft's guide (link below) before changing anything. Microsoft warns that turning this on can make older start-up or recovery drives stop working.",
    "If you are not comfortable with these steps, ask an IT helper. Do not skip the backup.",
    "Run the read-only check to see if the change is already on."
   ],
   "official_patch_links": [
    {
     "label": "Microsoft: how to manage the Windows Boot Manager revocations (KB5025885)",
     "url": "https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023"
    }
   ],
   "extra_checks": [
    {
     "platform": "windows",
     "label": "Is the old Windows start-up certificate already blocked? (True = blocked, False = not yet). Needs 'Run as administrator'.",
     "command": "[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'",
     "shell": "PowerShell (Admin)",
     "read_only": true
    }
   ],
   "sources": [
    {
     "url": "https://securelist.com/uefi-bootkit-blackx/121539/",
     "title": "Kaspersky Securelist: BlackX bootkit",
     "date": "2026-10-22",
     "kind": "research",
     "official": false
    },
    {
     "url": "https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023",
     "title": "Microsoft: Windows Boot Manager revocations for Secure Boot (KB5025885)",
     "date": "2023-05-09",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21894",
     "title": "NVD: CVE-2022-21894",
     "date": "2022-01-11",
     "kind": "nvd",
     "official": true
    }
   ]
  },
  {
   "id": "emudhra-fake-website-certificates",
   "url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates/",
   "path": "/incidents/emudhra-fake-website-certificates/",
   "json_url": "https://patchgap.ai/incidents/emudhra-fake-website-certificates.json",
   "title": "Fake website certificates: browsers and computers are blocking a certificate company's weak keys",
   "category": "browsers",
   "platforms": [
    "windows",
    "macos",
    "linux"
   ],
   "products": [
    "chrome",
    "firefox",
    "edge",
    "windows",
    "macos",
    "tailscale"
   ],
   "status": "partial",
   "status_label": "Partly patched",
   "severity": "high",
   "severity_source": "Mozilla and Google both treat it as a serious break in website trust. No score exists.",
   "exploited_in_wild": "no",
   "exploited_note": "Google says no fake certificates were found in public records before it blocked the keys. The company (eMudhra) says it issued no certificates from those keys.",
   "exploited_source_url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-17",
   "updated_at": "2026-10-27",
   "cves": [],
   "summary": "When you visit a secure website, your browser trusts a 'certificate' to prove the site is real. A company called eMudhra made weak secret keys for 8 of its certificate makers. Someone could use them to make fake certificates and pretend to be any website. Mozilla, Google, Apple and Microsoft all blocked those keys in the days after Oct 17. Most of this is automatic. Make sure your browser and your computer are up to date.",
   "am_i_affected": "Most people are already protected because the block went out by itself within hours. Browsers and computers that were offline, or had special settings, may be behind. Update your browser and your computer to be sure. Mac command-line tools still need a future Apple update.",
   "action": "Update your browsers, Windows, Mac and Tailscale",
   "affected": [
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "windows",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Click the three lines at the top right > Help > About Firefox. Firefox checks for updates there.",
      "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Mozilla Firefox*' | Select-Object DisplayName,DisplayVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "macos",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Firefox menu bar: Firefox > About Firefox.",
      "command": "defaults read \"/Applications/Firefox.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "firefox",
     "product_name": "Mozilla Firefox",
     "platform": "linux",
     "affected_versions": "Firefox with settings that stopped the automatic block",
     "fixed_version": "158.0.1 (ESR: 153.5.1 or 115.43.1)",
     "fixed_min": null,
     "fix_note": null,
     "fixed_source_urls": [
      "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
     ],
     "check": {
      "menu_path": "Firefox menu > Help > About Firefox.",
      "command": "firefox --version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.mozilla.org/firefox/new/"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "windows",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Click the three dots at the top right > Help > About Google Chrome. Chrome checks for updates there, then click Relaunch.",
      "command": "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "macos",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Chrome menu bar: Chrome > About Google Chrome.",
      "command": "defaults read \"/Applications/Google Chrome.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "chrome",
     "product_name": "Google Chrome",
     "platform": "linux",
     "affected_versions": "Chrome that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Chrome blocked the keys the same day with no update. It removes the whole root certificate in a release that began rolling out Oct 27, 2026.",
     "fixed_source_urls": [
      "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"
     ],
     "check": {
      "menu_path": "Chrome menu: three dots > Help > About Google Chrome.",
      "command": "google-chrome --version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.google.com/chrome/answer/95414"
    },
    {
     "product": "edge",
     "product_name": "Microsoft Edge",
     "platform": "windows",
     "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Click the three dots at the top right > Help and feedback > About Microsoft Edge.",
      "command": "(Get-Item \"${env:ProgramFiles(x86)}\\Microsoft\\Edge\\Application\\msedge.exe\" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.microsoft.com/edge/download"
    },
    {
     "product": "edge",
     "product_name": "Microsoft Edge",
     "platform": "macos",
     "affected_versions": "Edge that has not yet received the Oct 27 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft Edge blocks the keys automatically. Microsoft planned to remove the affected roots from Edge's trust list on Oct 27, 2026.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Edge menu bar: Microsoft Edge > About Microsoft Edge.",
      "command": "defaults read \"/Applications/Microsoft Edge.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.microsoft.com/edge/download"
    },
    {
     "product": "windows",
     "product_name": "Windows 10 and 11",
     "platform": "windows",
     "affected_versions": "Windows without Microsoft's Oct 26, 2026 trust-list update",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Microsoft released an out-of-band Windows update on Oct 26, 2026 that removes seven affected certificates.",
     "fixed_source_urls": [
      "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
     ],
     "check": {
      "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
      "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
    },
    {
     "product": "macos",
     "product_name": "macOS",
     "platform": "macos",
     "affected_versions": "Mac command-line tools (not Safari or other apps)",
     "fixed_version": null,
     "fixed_min": null,
     "fix_note": "Apple blocked the certificates automatically from Oct 19, 2026 (and the root on Oct 23). A future macOS update will block them in command-line tools too.",
     "fixed_source_urls": [
      "https://support.apple.com/en-us/149555"
     ],
     "check": {
      "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
      "command": "sw_vers -productVersion",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://support.apple.com/en-us/108382"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "windows",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon (tray on Windows, menu bar on Mac) and choose About Tailscale.",
      "command": "tailscale version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "macos",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Click the Tailscale icon in the menu bar > About Tailscale.",
      "command": "tailscale version",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://tailscale.com/download"
    },
    {
     "product": "tailscale",
     "product_name": "Tailscale",
     "platform": "linux",
     "affected_versions": "Tailscale older than v1.104.2",
     "fixed_version": "1.104.2",
     "fixed_min": "1.104.2",
     "fix_note": "Tailscale v1.104.2 (Oct 21, 2026) includes Go 1.27.3, which refuses the compromised certificates.",
     "fixed_source_urls": [
      "https://tailscale.com/security-bulletins",
      "https://tailscale.com/changelog"
     ],
     "check": {
      "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://tailscale.com/download"
    }
   ],
   "fix_steps": [
    "Update your browser: Chrome (three dots > Help > About Google Chrome), Firefox (three lines > Help > About Firefox), Edge (three dots > Help and feedback > About Microsoft Edge).",
    "Run Windows Update (Settings > Windows Update) and install everything, including the update from Oct 26.",
    "On a Mac, run Software Update (System Settings > General > Software Update).",
    "If you use Tailscale, update it to the newest version.",
    "A site that suddenly shows a certificate warning might use the blocked company. That is expected. Do not click through the warning. Tell the site owner."
   ],
   "official_patch_links": [
    {
     "label": "Mozilla: blog post about the eMudhra block",
     "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"
    },
    {
     "label": "Apple: about the compromised eMudhra certificates",
     "url": "https://support.apple.com/en-us/149555"
    },
    {
     "label": "Microsoft: response to the eMudhra keys",
     "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/",
     "title": "Mozilla Security Blog: Protecting Firefox users after the eMudhra compromise",
     "date": "2026-10-20",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/",
     "title": "Google: Protecting Chrome and Android users from compromised eMudhra certificates",
     "date": "2026-10-20",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://support.apple.com/en-us/149555",
     "title": "Apple Support: About the compromised eMudhra intermediate CAs",
     "date": "2026-10-23",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys",
     "title": "Microsoft MSRC: Response to compromised eMudhra keys",
     "date": "2026-10-26",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://tailscale.com/changelog",
     "title": "Tailscale changelog (Oct 21, 2026 entry)",
     "date": "2026-10-21",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://emudhra.com/en/post/certificate-security-incident",
     "title": "eMudhra: Statement on the certificate security incident",
     "date": "2026-10-21",
     "kind": "primary",
     "official": true
    },
    {
     "url": "https://tailscale.com/security-bulletins",
     "title": "Tailscale security bulletin TS-2026-013 (eMudhra certificates)",
     "date": "2026-10-21",
     "kind": "vendor",
     "official": true
    }
   ]
  }
 ]
}