Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Notepad++ version 8.9.2 double-lock update hardening

Security Patch Release
First reported
Last updated
Happening score
H score 27
1 unique sources, 1 articles

Summary

Hide ▲

Notepad++ version 8.9.2 introduces a double-lock update mechanism that reduces supply-chain compromise risk in the auto-update path. The release verifies the signed installer from GitHub and the signed XML from notepad-plus-plus.org, making the updater materially harder to abuse. Users are advised to upgrade to 8.9.2 and keep installers tied to the official domain.

Related Happenings

CPanel and WHM emergency update for critical auth-bypass

Security Patch Release
H score89 First: 29.04.2026 18:51 Last: 29.04.2026 18:51 Sources 1

About this happening: WebPros International released an emergency update for cPanel and WHM after a critical authentication-bypass flaw could expose supported installations to una...

Open Happening

Lotus Blossom Notepad++ updater compromise campaign

Campaign
H score28 First: 17.02.2026 20:29 Last: 17.02.2026 20:29 Sources 1

How related: Starting in June 2025, the bad actor compromised the hosting provider that ran the Notepad++ updater and selectively redirected update requests from specific users to malicious servers.

About this happening: The Lotus Blossom operation compromised the Notepad++ updater and selectively redirected update requests from specific users to malicious servers, creating a supply-ch...

Open Happening

Notepad++ hit by network compromise

Incident
H score17 First: 03.02.2026 06:55 Last: 03.02.2026 06:55 Sources 1

About this happening: The Notepad++ hosting breach enabled attackers to hijack the software update path and selectively redirect some users to malicious servers, creating a supply-chain ris...

Latest development: 18.02.2026 09:40

Notepad++ released version 8.9.2 to harden the update mechanism after the hijacked update path was used to deliver targeted malware. The release adds a "double lock" design with verification of the signed installer downloaded from GitHub and verification of the signed XML returned by the update server at notepad-plus-plus[.]org, and it also introduces WinGUp hardening including removal of libcurl.dll, removal of CURLSSLOPT_ALLOW_BEAST and CURLSSLOPT_NO_REVOKE, and restriction of plugin management execution to programs signed with the same certificate as WinGUp.

Open Happening

Microsoft security patch release for CVE-2026-20805

Security Patch Release
H score42 First: 14.01.2026 02:47 Last: 14.01.2026 02:47 Sources 1

About this happening: Microsoft released January 2026 security updates for Windows and supported software, fixing at least 113 vulnerabilities and 8 critical flaws. The release includes...

Open Happening

Microsoft January 2026 Patch Tuesday 114-flaw security update (multiple vulnerabilities)

Security Patch Release
H score40 First: 13.01.2026 20:34 Last: 13.01.2026 20:34 Sources 1

About this happening: Microsoft released its January 2026 Patch Tuesday update, fixing 114 flaws and raising urgency because it includes one actively exploited issue and two publicly...

Open Happening

Timeline

  1. 17.02.2026 20:29 1 articles · 4mo ago

    Notepad++ updater compromise discovered on December 2, 2025

    Detection Ioc Update

    The Notepad++ updater compromise was discovered on December 2, 2025 after a compromised hosting provider selectively redirected update requests to malicious servers and attackers exploited weak update verification controls in older versions of the software.

    Show sources
    Open in new tab
  2. 17.02.2026 20:29 2 articles · 4mo ago

    Notepad++ version 8.9.2 introduces double-lock updater hardening

    Mitigation Patch Update

    Notepad++ version 8.9.2 adds a double-lock update mechanism that verifies the signed installer from GitHub and the signed XML from notepad-plus-plus.org, removes libcurl.dll to reduce DLL side-loading risk, removes CURLSSLOPT_ALLOW_BEAST and CURLSSLOPT_NO_REVOKE, restricts plugin management execution to programs signed with the same certificate as WinGUp, and supports excluding the auto-updater with msiexec /i npp.8.9.2.Installer.x64.msi NOUPDATER=1.

    Show sources
    Open in new tab