Notepad++ Patches Updater Flaw After Reports of Traffic Hijacking

Notepad++ has patched a flaw in how its updater authenticates update files, after reports that traffic from the updater could be redirected to malicious servers. The vulnerability affected the WinGUp component, with security updates failing to execute if the updater could not verify the update’s origin. In the latest version, 8.8.9, Notepad++ and WinGUp now verify the installers’ signatures during updates, and the process is halted if the check fails.

Security researchers noted that traffic hijacking may have redirected harmful updates to victim machines, and it has yet to be determined exactly how these attacks operated in the wild. SecurityWeek reports that Kevin Beaumont stated the attacks appeared to be carried out by threat actors in China, who used the flaw to gain initial access to telecoms and financial services firms in East Asia, a claim linked to Beaumont’s update this week.

Beaumont’s assessment described the campaign as a supply‑chain attack with possible ISP‑level traffic manipulation, though the scale and methods would require significant resources to execute.