So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?

Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start? Though I would assume these malicious updates would be clever enough to rather have dropped and executed additional files, rather than doing something with the Notepad++ binaries themselves.

And I agree with another comment here. With all those spelling mistakes that notification kind of reads like it could have been written by a state-sponsored actor. Not to be (too) paranoid here, but can we be sure that this is the actual author, and that the new version isn't the malicious one?

▲

hinkley 5 hours ago | parent | next [-]

This reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it.

I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at the problem statement.

I still think I'd like to have a web of trust system where I let my friends try out software updates first before I do, and my relatives let me try them out before they do.

▲

Nition 4 hours ago | parent | next [-]

Ah, I remember those days. One that wasn't an error exactly was an assignment that had a word limit of 2000 words or something. I'd written maybe 3000 words and spent quite some time cutting it down, getting it to just under the limit. Then someone else who also wrote too many words asked the professor if that was okay and they sent out an update to everyone saying it's fine to ignore the word limit.

▲

nxpnsv 4 hours ago | parent [-]

So you accidentally learned how to edit a text? Sounds like a win to me…

	▲	Nition 4 hours ago \| parent [-]
		That's a nice positive way to view it. I would even say that was probably intended as a feature of the original assignment brief.

▲

ozim 4 hours ago | parent | prev [-]

For windows updates r/sysadmin has people who run updates and post their experience on patch Tuesday.

	▲	Melatonic 3 hours ago \| parent [-]
		You can delay by a week or two very easily and automatically as well

▲

tasuki 2 hours ago | parent | prev | next [-]

> So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?

Is this surprising? My model is that keeping with the new versions is generally more dangerous than sticking with an old version, unless that old version has specific known and exploitable vulnerabilities.

▲

illiac786 2 hours ago | parent [-]

Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that running an old software version. Try exposing a windows XP to the internet and watch how long it takes before it‘s hacked.

▲

card_zero 2 hours ago | parent [-]

Debatable. "I connected Windows XP to the Internet; it was fine" - https://news.ycombinator.com/item?id=40528117

One comment there points out that XP is old enough for infected attack vectors to have all died out. I dunno.

▲

illiac786 an hour ago | parent | next [-]

https://www.tomshardware.com/software/windows/idle-windows-x...

But good we are talking about my point rather than than the example.

	▲	badsectoracula 25 minutes ago \| parent [-]
		> YouTuber Eric Parker demonstrated in a recent video how dangerous it is to connect classic Windows operating systems The video referenced in that article explicitly connects directly to the internet, using a VPN to bypass any ISP and router protections and most importantly disables any protections WinXP itself has. So yeah, if you really go out of your way to disable all security protections, you may have a problem.

▲

bigfatkitten an hour ago | parent | prev [-]

I experienced this first hand in 2014. We got to a point where drive-by exploit kits just weren’t shipping IE8, Java 6 or Windows XP payloads anymore.

▲

FatalLogic 3 hours ago | parent | prev | next [-]

>I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?

Notepad++ site says The incident began from June 2025.

On their downloads page, 8.8.2 was the first update in June 2025 (the previous update 8.8.1 was released 2025-05-05)

So, if your installed version is 8.8.1 or lower, then you should be safe. Assuming that they're right about when the incident began.

edit: Notepad++ has published, on Github, SHA256 hashes of all the binaries for all download versions, which should let users check if they were targeted, if they still have the downloaded file. 8.8.1 is here, for example - https://github.com/notepad-plus-plus/notepad-plus-plus/relea...

	▲	z3t4 2 hours ago \| parent [-]
		Older download links doesn't seem to work!?

▲

otherme123 3 hours ago | parent | prev | next [-]

> And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start?

Did I understand the attack wrongly? The software could have a 100% correct checksum, because the attack happened in a remote machine that deals with call home events from Notepad++, I guess one of those "Telemetry" add-ons. The attackers did a MITM to Notepad++ traffic.

	▲	tempestn 2 hours ago \| parent [-]
		The remote machine that was compromised was responsible for Notepad++ updates, so the concern is that it could cause a compromised version of the software to be installed. But if it could do that, it could probably cause anything to be installed anywhere on the user's machine, so inspecting the installed N++ binary probably wouldn't be too useful.

▲

FpUser 4 hours ago | parent | prev | next [-]

8.4.7 here. phew

	▲	topspin 3 hours ago \| parent [-]
		8.5.7 here (built Sept 6, 2023) Now I need to worry about this one. I've been anxious about vscode lately: apparently vscode extensions are a dumpster fire of compromises.

▲

user3939382 4 hours ago | parent | prev [-]

If there’s anything I’ve learned from IBM, Red Hat, and CentOS, it’s that bleeding edge is actually what I’m supposed to want.