Notepad++ Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware
Summary: Notepad++ released version 8.9.2 with a "double lock" update design that verifies both the signed installer from GitHub and the signed XML returned by the update server at notepad-plus-plus[.]org, and it fixes a high-severity unsafe search path flaw (CVE-2026-25926, CVSS 7.3) that could allow arbitrary code execution. The fix follows disclosure that a hosting provider breach let a China-nexus group called Lotus Panda hijack update traffic from June 2025 until detection in early December 2025, redirecting some users to malicious servers to deliver a backdoor dubbed Chrysalis under CVE-2025-15556 (CVSS 7.7).
What's compelling: The attackers did not break Notepad++'s code; they compromised its hosting provider and served a poisoned update to targets across Vietnam, El Salvador, Australia, the Philippines, the U.S., South America, and Europe in cloud hosting, energy, financial, government, manufacturing, and software development. If your update chain trusts a server you do not control, the signature check you rely on may be the only thing between your endpoints and a backdoor like Chrysalis.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-15556CVE-2026-25926
- Related
- CVE-2025-15556: Notepad++ Download of Code Without Integrity Check Vulnerability Known Exploited Vulnerabilities · Feb 12, 2026