{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "notepad-plus-plus",
  "name": "Notepad++",
  "short_name": "Notepad++",
  "page_url": "https://patchgap.ai/is-my-notepad-plus-plus-up-to-date/",
  "minimum_safe_version": "8.9.1",
  "minimum_safe_version_source": [
   {
    "url": "https://notepad-plus-plus.org/news/clarification-security-incident/",
    "title": "Notepad++: Important Clarification: Notepad++ Security Incident",
    "date": "2026-02-05",
    "kind": "vendor"
   },
   {
    "url": "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix",
    "title": "Notepad++ Community (official): Notepad++ v8.8.9 release notes",
    "date": "2025-12-09",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": "8.9.1",
   "applies_to": "all platforms listed for this product",
   "source_incident": "notepad-plus-plus-updater-hijack-2026",
   "sources": [
    {
     "url": "https://notepad-plus-plus.org/news/clarification-security-incident/",
     "title": "Notepad++: Important Clarification: Notepad++ Security Incident",
     "date": "2026-02-05",
     "kind": "vendor"
    },
    {
     "url": "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix",
     "title": "Notepad++ Community (official): Notepad++ v8.8.9 release notes",
     "date": "2025-12-09",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": true,
   "caveats": [],
   "text": "You're covered against everything listed here if you're on Notepad++ 8.9.1 or newer."
  },
  "update_steps": {
   "windows": [
    "Go to notepad-plus-plus.org/downloads (type the address yourself).",
    "Download the newest installer and run it."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Notepad++ (Don Ho)",
  "category": "apps",
  "platforms": [
   "windows"
  ],
  "what_it_is": "A free text and code editor for Windows.",
  "url": "https://patchgap.ai/is-my-notepad-plus-plus-up-to-date/",
  "json_url": "https://patchgap.ai/products/notepad-plus-plus.json",
  "official_site": "https://notepad-plus-plus.org/",
  "official_download": "https://notepad-plus-plus.org/downloads/",
  "how_it_updates": "Notepad++ can check for updates (? > Update Notepad++). The safest way is to download the newest installer from notepad-plus-plus.org.",
  "check": {
   "windows": {
    "menu_path": "Open Notepad++ > ? menu > About Notepad++.",
    "command": "(Get-Item \"$env:ProgramFiles\\Notepad++\\notepad++.exe\").VersionInfo.ProductVersion",
    "shell": "PowerShell",
    "read_only": true
   }
  },
  "open_incidents": [
   "notepad-plus-plus-updater-hijack-2026"
  ]
 },
 "incidents": [
  {
   "id": "notepad-plus-plus-updater-hijack-2026",
   "url": "https://patchgap.ai/incidents/notepad-plus-plus-updater-hijack-2026/",
   "path": "/incidents/notepad-plus-plus-updater-hijack-2026/",
   "json_url": "https://patchgap.ai/incidents/notepad-plus-plus-updater-hijack-2026.json",
   "title": "Notepad++: its old updater could be tricked into installing a fake update, and attackers did it",
   "category": "apps",
   "platforms": [
    "windows"
   ],
   "products": [
    "notepad-plus-plus"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
   "exploited_in_wild": "yes",
   "exploited_note": "Notepad++ says a state-backed group used it against selected organizations. CISA lists it as used in real attacks (added Feb 12, 2026).",
   "exploited_source_url": "https://notepad-plus-plus.org/news/clarification-security-incident/",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-02-05",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2025-15556"
   ],
   "summary": "Notepad++ is a free text editor for Windows. Its built-in updater did not check that an update really came from Notepad++. Attackers who took over the old hosting company sent fake updates to some chosen targets. Version 8.8.9 added the check, and the maker says to install 8.9.1 or newer.",
   "am_i_affected": "You are at risk if Notepad++ is older than 8.9.1. Most home users were not targeted, but you should still update.",
   "action": "Download Notepad++ 8.9.1 or newer from notepad-plus-plus.org",
   "affected": [
    {
     "product": "notepad-plus-plus",
     "product_name": "Notepad++",
     "platform": "windows",
     "affected_versions": "Notepad++ before 8.8.9 (the maker recommends 8.9.1 or newer)",
     "fixed_version": "8.9.1 (first fix in 8.8.9)",
     "fixed_min": "8.9.1",
     "fix_note": null,
     "fixed_source_urls": [
      "https://notepad-plus-plus.org/news/clarification-security-incident/",
      "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix"
     ],
     "check": {
      "menu_path": "Open Notepad++ > ? menu > About Notepad++.",
      "command": "(Get-Item \"$env:ProgramFiles\\Notepad++\\notepad++.exe\").VersionInfo.ProductVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://notepad-plus-plus.org/downloads/"
    }
   ],
   "fix_steps": [
    "Open notepad-plus-plus.org and click Download (type the address yourself).",
    "Download the newest installer and run it.",
    "You can turn off the auto-updater during install if you prefer."
   ],
   "official_patch_links": [
    {
     "label": "Notepad++: official downloads",
     "url": "https://notepad-plus-plus.org/downloads/"
    },
    {
     "label": "Notepad++: security incident note",
     "url": "https://notepad-plus-plus.org/news/clarification-security-incident/"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://notepad-plus-plus.org/news/clarification-security-incident/",
     "title": "Notepad++: Important Clarification: Notepad++ Security Incident",
     "date": "2026-02-05",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix",
     "title": "Notepad++ Community (official): Notepad++ v8.8.9 release notes",
     "date": "2025-12-09",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-15556 (added 2026-02-12)",
     "date": "2026-02-12",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15556",
     "title": "NVD: CVE-2025-15556",
     "date": "2026-02-12",
     "kind": "nvd",
     "official": true
    }
   ]
  }
 ]
}