Patch My PC

Patch My PC is happy to announce that a new SOC 2 Type II report is available and can be found in the Overview Tab or the Resources Tab. The new report covers an audit period of April 1, 2025 to March 31, 2026.

For increased clarity, we have implemented some new features in the trust center and provided a short written explanation on the usage of each of our subprocessors. The new feature allows the usage of tagging, to define what the subprocessors are used for. We have added, internal, cloud, on-prem, website and tagged each of the subprocessors to their appropriate use cases. Our goal with this is to provide clarity when trying to understand which services use which tools. Tools marked with only the internal tag, are back office tools used for running the business that may process the first and last name of the contract holder or the administrator. Additionally, a short purpose statement has been added to each subprocessor.

Hello everyone, Our latest penetration test report, along with an attestation signed by our Director of Security & IT, has been released for customer review. These documents can be found in the Resources tab. We've also updated our FAQ page. You'll find expanded FAQ categories for easier navigation as well as a new section about the PSADT App Migration AI tool we've added into Patch My PC Cloud. If there are any questions, please feel free to reach out to security@patchmypc.com.

Patch My PC is aware of a supply‑chain attack (Notepad++ Hijacked by State-Sponsored Hackers | Notepad++) that redirected legitimate Notepad++ update traffic to malicious servers between June and December 2025, affecting only users who used the app’s internal updater. Organizations using Patch My PC were protected, assuming the end user did not leverage the built in update service in Notepad++. Our process downloads vendor‑supplied binaries directly from their GitHub repository and blocks anything that fails strict hash validation (Security Validation of Updates & Apps: Deep Dive - Patch My PC), which prevented any tampered Notepad++ update from being deployed. To be on the safe side you should assume the automatic updater was used during the six-month window by some users in your org. Therefore, we recommend ensuring all users have the latest Notepad++ version (at least 8.8.9) installed and then investigating using your EDR tooling. Rapid 7 has published, what they believe to be an IOC, and some files to investigate; Message from Rapid7 Chat

A recently disclosed vulnerability in React RSC (CVE-2025-55182) has been brought to our attention. Patch My PC has thoroughly reviewed this issue and confirmed that our products do not utilize the affected NPM packages. Furthermore, we have additional safeguards in place through Cloudflare to provide enhanced protection. We will continue to monitor the situation and maintain our commitment to security best practices.