For almost half of 2025, an update server for Notepad++ was compromised by Chinese state-sponsored threat actors. According to an official statement from the Notepad++ team, the attackers were able to intercept and redirect update requests from users. The redirect would point them instead to malicious servers.
According to the app's developer, Don Ho, and "multiple independent security researchers," the hijack of the update server began in June 2025. Notepad++'s former hosting partner says that the shared hosting server was compromised until September 2, 2025. It was on that date when the compromised server's kernel and firmware were update. However, the attackers still "maintained credentials to internal services until December 2, 2025." This allowed the state-sponsored threats to "continue redirecting Notepad++ update traffic to malicious servers."
According to Ho, the attackers specifically targeted the Notepad++ domain "with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++."
Several additional security measures have been put in place. These improvements include an update to the Notepad++ updater (WinGup) that will now verify both the certificate and the signature of the downloaded installer. The update server will now use signed XML (XMLDSig) and in the upcoming v8.9.2 update for Notepad++, the certificate and signature verification will be strictly enforced. The Notepad++ website was also moved to a new hosting provider that provides "significantly stronger security practices."
What can you do if you're using Notepad++? It's simple: Update to v8.9.1 of Notepad++ immediately. This is the latest release and includes multiple security enhancements outlined above. Ho says that you should download the installer and run this 8.9.1 update manually in lieu of running the built-in updater.
Notepad++ is a free and open-source program that can be a replacement for the built-in Windows Notepad and code editor. It features support for themes, plugins, syntax highlighting, find and replace using regular expressions, macros, and more. The developer of Notepad++ has been quite vocal about various political causes, particularly with regard to human rights. Several versions of Notepad++ included codenames such as "Free Uyghur," "Stand with Hong Kong," "Boycott Beijing 2008," and more that voiced support for Ukraine and Taiwan.
