Urgent Patch: Notepad++ WinGUp Flaw Allowed Malware to Hijack Updates

News of urgency surrounds Notepad++ after a WinGUp flaw allowed malware to hijack updates, with SecurityOnline[.]info noting that researchers uncovered the vulnerability which, in certain regions, could redirect the update process and deliver a tampered executable. The flaw has been patched in Notepad++ v8.8.9, and users running older versions are urged to scan thoroughly and consider a full system reinstall if already compromised.

According to the developers, the update utility WinGUp could be redirected to a malicious server, enabling interception of the download URL and the retrieval of malicious payloads from the %TEMP% directory via an XML file generated by the update endpoint.

Notable mitigations include the shift from a self-signed certificate to a trusted GlobalSign certificate from version 8.8.7, the requirement from 8.8.8 that WinGUp use GitHub[.]com as the sole download source, and the improved validation in 8.8.9 of the downloaded file’s signature and certificate. While the exact method of traffic hijacking remains under investigation, evidence suggests attackers have already exploited the vulnerability against specific targeted organisations.