Notifications
Clear all
Topic starter
20/08/2026 5:26 pm
TL;DR: Notepad++ disclosed that attackers tampered with automatic update delivery through its hosting provider, causing some users to receive malicious payloads and, in reported cases, targeted delivery to a small number of organizations, according to Expel. The incident shows how software distribution trust can be abused even when the overall blast radius is limited, and why update integrity, provenance, and host-level controls matter.
NHIMG editorial — based on content published by Expel: Notepad++ update tampering incident analysis
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What fails when a trusted software update channel is tampered with?
A: The failure is the assumption that a legitimate software channel is safe by default.
Q: Why are targeted supply-chain attacks hard to detect early?
A: They often affect only a small set of organisations, which makes the activity look low volume rather than high risk.
Q: What do security teams get wrong about software supply chain risk?
A: They often focus on known vulnerabilities inside dependencies and miss the trust path that delivers the software.
Practitioner guidance
- Harden update provenance controls Require signed binaries, validate hashes at install time, and compare the delivery path against approved publisher domains before execution on managed endpoints.
- Inventory software on privileged endpoints Identify which admin, developer, and engineering workstations run high-trust tooling so you can separate routine applications from machines used for sensitive sessions.
- Scope impacted hosts by delivery path Use endpoint and proxy logs to determine exactly which systems fetched the tampered update and whether any follow-on payload was staged from secondary infrastructure.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Rapid7 indicators of compromise and incident artifacts that help teams confirm whether a specific endpoint was exposed.
- The reported targeting pattern and payload staging details that matter for scoping affected organisations.
- The incident timeline and evidence chain needed to support internal investigation and communications.
- The source references that document the update tampering path and provide additional context for response teams.
👉 Read Expel's analysis of the Notepad++ update tampering incident →
Notepad++ update tampering: what it means for software supply chains?
Explore further
20/08/2026 6:15 pm
Software delivery trust is an identity problem as much as a supply-chain problem. When a trusted updater can be redirected or modified, the issue is not merely binary integrity. It is the trust relationship between publisher, host, endpoint, and the user context that accepts the update. For practitioners, this means update channels must be governed like privileged pathways, not treated as ordinary downloads.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when update tampering reaches production endpoints?
A: Accountability is shared across software publishing, hosting, endpoint management, and identity governance. Security teams, IT operations, and software owners all have a role because the compromise crosses release, delivery, and session trust boundaries. Frameworks such as NIST SP 800-53 and supply-chain controls are useful for assigning those responsibilities.
👉 Read our full editorial: Notepad++ update tampering shows how software delivery can be abused
