After the security issue was announced with Notepad++ version 8.8.9, investigators have been working with cybersecurity experts and the hosting company to understand what happened. The investigation shows that attackers broke into the hosting provider’s systems rather than exploiting any weakness in Notepad++ itself.
What Happened
Security researchers found that attackers gained unauthorized access to the shared hosting infrastructure that ran notepad-plus-plus.org. This allowed them to intercept and redirect some update requests.
Rather than changing Notepad++ code or its update system directly, the attackers took advantage of security gaps in the hosting environment. They manipulated requests going to the update endpoint at /update/getDownloadUrl.php. Some users were quietly redirected to servers controlled by the attackers, which sent back malicious update information or download links. This let attackers deliver compromised installers to specific targets while most users remained unaffected.
Investigators are still working to determine exactly how the attackers initially broke into the hosting provider’s systems, but current evidence points to a breach in the provider’s infrastructure rather than any problem with Notepad++ software.
Who Was Behind the Attack
The campaign started around June 2025. Independent security researchers studying the operation found patterns typical of state-sponsored hacking groups. Several experts believe a Chinese government-aligned threat group was likely responsible.
This assessment is based on several factors: the attackers targeted very specific victims rather than trying to infect everyone, they had sophisticated capabilities to access infrastructure-level systems, they maintained long-term access using advanced techniques, and they specifically focused on software distribution infrastructure. Only update traffic for the Notepad++ domain appeared to be targeted, and there’s no evidence that other customers on the same hosting system were affected.
Hosting Provider’s Investigation
The Notepad++ maintainer, incident response experts, and the hosting provider worked together to investigate. The provider released a detailed technical report with several key findings.
When the Server Was First Compromised
The shared hosting server that handled Notepad++ updates was compromised until September 2, 2025. On that date, the hosting company performed scheduled maintenance that updated the server’s kernel and firmware. After these updates, logs stopped showing signs of attacker access, which means the initial entry point was eliminated. No similar compromise was found on other hosting servers.
Continued Access Through Stolen Login Information
Even though the attackers lost direct server access after September 2, they had stolen credentials for internal hosting services that remained valid until December 2, 2025. These stolen credentials allowed them to continue redirecting some update traffic, provide malicious download URLs, and maintain limited control over the update process. This means the attackers could still cause harm even after their main access point was closed.
Focus on Notepad++ Systems
Analysis of server logs showed that attackers specifically searched for the Notepad++ domain and update endpoints. Their goal was to intercept update traffic, probably taking advantage of weaker security checks in older versions of the updater. No other hosted websites showed signs of being targeted.
Complete Cleanup
By December 2, 2025, the hosting provider finished steps that completely blocked the attackers. They patched the vulnerabilities that were used during the break-in, changed all potentially compromised passwords and credentials, and confirmed that subsequent attacker attempts to regain access failed. Logs across all hosting systems showed no further signs of compromise. The hosting provider advised all customers to change their passwords and update their WordPress installations as a safety measure.
Attack Timeline
Two different timelines emerged from the investigation. External security experts estimated the attack ended around November 10, 2025, while the hosting provider’s internal logs indicated it continued until December 2, 2025. Combining both assessments, the compromise period likely spanned from June 2025 to December 2, 2025, with December 2 being when all attacker access was definitively eliminated.
Security Improvements
New Hosting Infrastructure
To eliminate any lingering risks from the compromised systems, the Notepad++ website and update services have been moved to a new hosting provider with stronger security controls.
Stronger Update Security
Security improvements have been added to Notepad++ itself. Starting with version 8.8.9, the WinGup updater now verifies that installer certificates are authentic and validates installer digital signatures. Additionally, update information returned by servers is now cryptographically signed using XMLDSig technology. Full enforcement of certificate and signature validation is scheduled for Notepad++ version 8.9.2, expected about one month after the 8.8.9 release. These changes significantly reduce the risk of tampered updates even if hosting infrastructure gets compromised in the future.
Conclusion
This incident shows that software distribution infrastructure remains an attractive target for sophisticated threat actors. While Notepad++ code and build processes were never compromised, attackers successfully exploited weaknesses in hosting infrastructure to manipulate update delivery for selected victims. With the move to new infrastructure complete and stronger update verification now in place, the attack method used in this campaign has been effectively shut down. Ongoing monitoring and security improvements continue to prevent similar incidents from happening again.