Notepad++ declares hardened update process 'effectively unexploitable'

Notepad++ disclosed that a state-sponsored actor (attributed to the Chinese-linked APT "Lotus Blossom") compromised its update service and selectively redirected update traffic to an attacker-controlled site serving malware disguised as legitimate updates. In response, the project released hardened versions that enforce signed XML and installer verification, removed a vulnerable libcurl.dll dependency, restricted plugin execution to components signed with the updater certificate, removed insecure cURL SSL options, and provided options to disable the auto-updater or deploy MSI without it.