PatchLevelManager only rejected dates more than ~1 year in the past. A MITM serving <td>2099-12-31</td> from a spoofed bulletin response slipped through validation and got written to security_patch.txt plus resetprop'd. Add a 60-day upper bound past today using LocalDate.plusDays so month boundaries are handled correctly. The existing past bound stays.