Supply-chain attacksBriefConfirmed by two or more outlets
Notepad++ update infrastructure hijack (CVE-2025-15556), Jun to Dec 2025
China-nexus Lotus Blossom compromised the hosting provider and selectively served malicious updates.
- Disclosed
What happened
- China-nexus Lotus Blossom compromised the hosting provider and selectively served malicious updates. WinGUp did not verify signatures before 8.8.9. Double verification arrived in 8.9.x.
Live scores
Live scores
CVE-2025-15556- EPSS
- 0.017
some chance of attack soon - VEDAS
- 0.970
strong exploit evidence - On CISA KEV
- Yes, since 2026-02-12
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/
- https://thehackernews.com/2026/02/notepad-fixes-hijacked-update-mechanism.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.