2026-02-02 20:50 UTC
@vrtxd@piipitin.fi 👉🏾 "[...] the attack involved infrastructure-level compromise [...] at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. [...] Multiple independaent security researchers have assessed that the threat actor is likely a Chinese state-sponsored group".
So, the incident says nothing about the developer's reliability! 😉
Replies (2)
-
@vrtxd@piipitin.fi 2026-02-03 01:53
@LorenzoAncora@ieji.de "The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++." Yes. It was a solo developer and a hosting provider against superpower-sponsored attackers, it seems. They did their best choosing a reliable hosting provider and making the software secure, and users might still lose trust. I don't blame anyone, I'm just stating options for migration.
-
@Network@cmx.xuzhou-jiang.su 2026-03-06 01:45
@LorenzoAncora@ieji.de 开发者说他要给政见与他不一样的用户的代码中注入隐蔽的随机字符🌚