Notepad++ Locks Down Updates After Supply Chain Attack

Notepad++, one of the world’s most popular text editors, has released version 8.9.2 to address a serious supply chain compromise that allowed attackers to hijack its update mechanism and deliver targeted malware.

What Happened

• Between June 2025 and December 2025, attackers exploited a breach at the hosting provider level to redirect update traffic.
• The tampered updates delivered a backdoor dubbed Chrysalis, attributed to the China‑nexus group Lotus Panda.
• The incident was tracked as CVE‑2025‑15556 (CVSS 7.7) and highlighted the risks of poisoned update channels.

The Fix in 8.9.2

Maintainer Don Ho introduced a “double lock” design to make updates “robust and effectively unexploitable”:

• Installer verification: Signed installer checks (added in 8.8.9).
• XML verification: Signed XML validation from the update server.
• WinGUp hardening:
  • Removed libcurl.dll to prevent DLL side‑loading.
  • Removed insecure SSL options (CURLSSLOPT_ALLOW_BEAST, CURLSSLOPT_NO_REVOKE).
  • Restricted plugin execution to programs signed with the same certificate.

Additionally, a new patch addresses CVE‑2026‑25926 (CVSS 7.3), an unsafe search path vulnerability that could allow arbitrary code execution via a malicious explorer.exe.

Why It Matters

• Supply chain attacks: Compromising update mechanisms gives adversaries direct access to trusted environments.
• Developer risk: Notepad++ is widely used by developers, making it a high‑value target.
• Trust erosion: Hijacked updates undermine confidence in open‑source software ecosystems.

Defensive Recommendations

• Update immediately: Move to Notepad++ version 8.9.2.
• Verify sources: Only download installers from the official domain.
• Audit plugins: Ensure plugin management is restricted to trusted certificates.
• Monitor systems: Watch for signs of Chrysalis backdoor activity.

Final Thought

The Notepad++ incident is a reminder that update mechanisms are prime attack surfaces. By hardening its auto‑update process, the project sets a precedent for how open‑source tools can defend against supply chain compromises. For organizations, the lesson is clear: trust must be verified, even in the tools we use every day.