Archive — US — techcrunch
Notepad++ says Chinese government hackers hijacked its software updates formonths
In 2025, Notepad++ confirmed that hackers linked to the Chinese government hijacked its software updates for several months, delivering malicious code to users, particularly targeting organizations with interests in East Asia. The breach, identified by security experts, highlights vulnerabilities in open-source software and recalls previous incidents like the SolarWinds attack.
Key points
- Notepad++ experienced a cyberattack from June to December 2025, linked to Chinese government hackers.
- The attack involved hijacking the software update process, leading to malicious updates being delivered.
- The attackers targeted a shared hosting server of Notepad++'s website using a software vulnerability.
- The campaign was selective, impacting a small number of organizations in East Asia.
- Logs indicated attempts to exploit vulnerabilities even after the bug was fixed in November.
- The incident has raised concerns about the security of open-source software, given Notepad++'s popularity.
Why it matters
- The Notepad++ breach parallels the SolarWinds attack where Russian hackers compromised software updates, affecting numerous government agencies.
- Concerns about software supply chain security continue to grow, aligning with increasing cyber threats observed in 2025.
- The ease of exploiting vulnerabilities in shared hosting environments highlights ongoing challenges in IT security.
The Notepad++ incident underscores the ongoing risks posed by state-sponsored hacking and the vulnerabilities within open-source software, echoing past breaches like SolarWinds and emphasizing the need for heightened cybersecurity measures.