PatchNotice tells website owners when their site runs outdated software with known security holes. One short, automatic email saying what to update. Built and run by Abdelrahman, nothing for sale.
Today, 9:41
PatchNotice
notice@patchnotice.org to security@example.org
Hi example.org team. Here's what your server shows to any visitor:
CHANGELOG.txt → Drupal 7.57
Server header → Apache/2.4.52 (Ubuntu)
Those versions have known security holes, including:
Moving to a supported Drupal release and applying Ubuntu's security updates fixes both. Reply “stop” and example.org is never emailed again.
When a site runs software with a known security hole, the scanner writes to the address that site publishes for it: what it saw, why it matters and what to update. Each notice is built from that evidence and sent once, and a reply saying “stop” ends it automatically.
An automated scanner looks at public websites, compares what it sees with public lists of security holes, and emails the owner. Nothing is tested, guessed or forced.
The same way your browser does. Many sites mention which software they run, and which version, to every visitor.
GET / → 200 OK
Server: Apache/2.4.52 (Ubuntu)
Content-Type: text/html; charset=UTF-8
GET /CHANGELOG.txt → 200 OK
Drupal 7.57
Security agencies list the known holes in each version, and the ones attackers already use. The scanner checks what it saw against them.
One short, automatic note to an address the site publishes: its security.txt contact, or, if it has none, the one on its contact page. A site that publishes neither gets no email.
Contact: mailto:security@example.org
Usually it's one update. That's the whole point. There's nothing to reply to, and the scanner never comes back on its own.
No further email. Nothing to reply to.
Look, never touch. The scanner reads what a website already shows every visitor. It never tries a security hole to see if it works, never logs in, and never fills in a form.
Why I do this0 logins · 0 forms · 0 exploit attempts
~100,100
Each one visited once, since 7 November 2026.
~5,400
About 1 in 19 of the sites checked.
56%
Of those include a hole attackers are using right now.
Updated 10 November 2026
Passive GET requests only, matched against NVD, CISA KEV and EPSS. The details, including where it can be wrong.
If it came from notice@patchnotice.org, yes. A real notice names your domain, quotes exactly what was observed and where, and lists CVE numbers you can look up yourself on nvd.nist.gov. It never has attachments and never asks for a password, money or access. If an email claiming to be from PatchNotice does, it isn't genuine, and you can forward it to notice@patchnotice.org.
Your website shows which version of some software it runs, for example a CHANGELOG.txt saying Drupal 7.57, or a Server header saying Apache/2.4.52. Public security databases list known security holes in that version, and the email names them.
It is not a claim that anyone has broken in, or that the hole definitely works on your site. Where a hole is in CISA's Known Exploited Vulnerabilities catalog, the email says so, because those are being used in real attacks.
Update the software the email names, or forward the email to whoever looks after your website. You don't need to reply.
No. The scanner made a handful of ordinary requests, the same ones a browser makes when it opens your homepage, plus requests for public files such as readme.html and security.txt. No exploits, no logins, no forms, and no check of whether any hole works. The full list is on How it works.
From your own website: the Contact line in your /.well-known/security.txt, or, if it has none, the address on your contact page. A site that publishes neither gets no email. No bought lists, no guessed addresses and no mailing list. You get one email per domain, and that's it.
That happens. Version-based matching can be wrong. Linux distributions such as Debian, Ubuntu and Red Hat backport security fixes without changing the version number, so a server can report a vulnerable version and still be patched. A notice may occasionally reach an operator who has already fixed the problem. When the version string points to a distribution build, the notice says so and marks those CVEs as conditional.
Then there's nothing to do. The scanner doesn't come back to check, so you won't get a follow-up. If you want to point out the mistake, reply: replies are forwarded to me and help improve the matching.
Here's what it means, and what to do next.