The update mechanism for the widely used open-source text editor Notepad++ has been significantly strengthened following its recent compromise. Don Ho, the application's author, announced that the mechanism is now "effectively unexploitable."
This enhancement coincides with the release of Notepad++ version 8.9.2, which introduces a double-lock verification system to ensure that any downloads of the software are legitimate. The new version includes a verification step for the signed XML returned by the update server, in addition to the previous security measures implemented in version 8.8.9, which was released in December. This earlier version already verified the authenticity of the signed installer downloaded from GitHub.
Additionally, the auto-updater has received further reinforcement.
Ho acknowledged in his blog that while these measures are robust, they are not infallible. Attackers could potentially exclude the auto-updater during the user interface installation or deploy the installer using a command that disables the updater.
In an email to CSOonline, Ho stated that while no system can be declared completely unbreakable, the new design significantly raises the security threshold. An attacker would now need to compromise both the hosting infrastructure and the signing keys. The updater now checks both the manifest and the installer, each with separate cryptographic signatures. Any discrepancies, missing signatures, or certificate issues will automatically halt the update process.
Ho emphasized that this layered verification approach enhances the resilience of the update chain, even in light of potential future infrastructure-level compromises.
Another supply chain attack
Ho explained that the compromise remained undetected for an extended period because only a small percentage of users, less than 0.1%, were specifically targeted by the attackers. He noted that the attackers acted with caution, aiming for long-term espionage, which allowed them to remain undetected for as long as possible.
Compromising an application’s update mechanism is a well-known tactic for threat actors, enabling them to infiltrate numerous organizations that unknowingly use the compromised version of the software. Notable examples include the SolarWinds Orion network monitoring suite compromise in 2019/2020 and the 2017 NotPetya attack, which spread globally following a breach of a Ukrainian tax application.
The Notepad++ issue began when it was discovered that the IT infrastructure hosting the application had been compromised in June 2025. A custom backdoor was installed, allowing attackers to selectively redirect traffic from specific users to their servers through malicious updates. Researchers at Rapid7 believe that a China-based group known as Lotus Blossom was behind the attack.
The former hosting provider indicated that the shared hosting server had been compromised from June to September 2025. However, the attackers retained access to internal services until December 2, 2025, continuing to reroute Notepad++ update traffic. The release of version 8.8.9 and the subsequent security hardening eliminated all unauthorized access. Version 8.9.1 included further security enhancements, while version 8.9.2 introduced the double-lock process.
Lessons learned
Ho emphasized that developers need to anticipate adversaries who are patient, sophisticated, and selective. He pointed out that infrastructure is a critical part of the attack surface; even secure code can be undermined by weak links in hosting, DNS, or content delivery networks. Continuous monitoring and strict credential management are vital, and developers should design applications and their delivery mechanisms with the possibility of partial compromise in mind.
He added that in the event of a compromise, swift disclosure, detailed technical information, and prompt fixes are essential for users to understand the impact and maintain trust in the project.
Jeff Pollard, who leads Forrester Research’s work on the role of the Chief Security Officer, noted that the fixes implemented significantly reduce the likelihood of recurrence for this specific failure mode. However, he cautioned that no single change can eliminate all supply chain risks. Attackers can pivot to other vulnerabilities in build pipelines or signing keys. Pollard remarked that Notepad++ effectively closed the exploited gap and increased the cost for attackers.
Small utilities like Notepad++ often fall outside procurement, inventory, and third-party risk management controls, making them popular among technical users and attractive targets for adversaries.
Douglas McKee, Rapid7’s senior director of vulnerability intelligence, stated that the Notepad++ supply chain incident highlights a broader shift in how threat actors perceive software trust and persistence. While the updates to Notepad++ and the introduction of enhanced double-lock update security address the specific vulnerability exploited in this incident, they do not resolve the overarching issue of modern supply chain risk.
McKee emphasized that organizations must recognize that supply chain security should not be confined to source code and build systems. Attackers targeted the hosting infrastructure and update delivery processes outside of the project's direct control. It is crucial to strengthen signature and certificate validation and to consider update infrastructure as part of the attack surface to effectively reduce exposure.
