Notepad++ 8.9.2 hardens the update mechanism after hijack

Notepad++ has released version 8.9.2, primarily to strengthen the security of its update mechanism. In 2025 a threat actor hijacked the project's update infrastructure and redirected selected users to malicious downloads by exploiting weak checks in older versions of the updater. The project states that the breach occurred at the hosting provider level and was used to serve malware selectively, rather than stemming from a flaw in the editor itself. The new version introduces a double-lock verification that checks both the signed update manifest and the installer.

What this means for your organisation

Notepad++ sits on a great many developer and operations machines, often installed by the user and outside the organisation's software inventory. When the update channel of such a tool is abused, malware arrives through a channel the machine is configured to trust. The point is not this one editor, but that every self-updating application is an entry route of its own that you should know about.

Berigo recommends

• Identify which machines have Notepad++ installed and upgrade to 8.9.2 obtained from the project's official site.
• Review which applications update themselves without IT involvement, and consider distributing them centrally instead.
• Look for unexpected downloads and installations from developer machines during the period the tool was exposed.
• Treat self-updating software as a distinct risk in your software and supplier inventory.

Source

• notepad-plus-plus.org
• notepad-plus-plus.org