{"id":10740,"date":"2026-02-18T10:03:40","date_gmt":"2026-02-18T10:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/18\/notepad-v8-9-2-released-with-double-lock-update-mechanism-following-recent-hack\/"},"modified":"2026-02-18T10:03:40","modified_gmt":"2026-02-18T10:03:40","slug":"notepad-v8-9-2-released-with-double-lock-update-mechanism-following-recent-hack","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/18\/notepad-v8-9-2-released-with-double-lock-update-mechanism-following-recent-hack\/","title":{"rendered":"Notepad++ v8.9.2 Released with \u201cDouble-Lock\u201d Update Mechanism Following Recent Hack"},"content":{"rendered":"

Notepad++ v8.9.2 Released with \u201cDouble-Lock\u201d Update Mechanism Following Recent Hack
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The widely used open-source text and code editor has released version\u00a0v8.9.2, introducing a major security enhancement known as the\u00a0\u201cDouble-Lock\u201d update mechanism.<\/p>\n

This update addresses vulnerabilities that were exploited in a recent state-sponsored attack\u00a0targeting the application\u2019s update infrastructure.<\/p>\n

Last month, Notepad++\u2019s official site confirmed that attackers had successfully hijacked<\/a> its update channel, allowing the distribution of a malicious update.<\/p>\n

Following the incident, the development team promised to fortify the update verification process. That promise has now been fulfilled with the v8.9.2 release.<\/p>\n

Strengthening the Update Process<\/strong><\/h2>\n

The latest release introduces<\/a>\u00a0XMLDSig (XML Digital Signature)\u00a0verification for update files.<\/p>\n

The\u00a0XML returned by Notepad++\u2019s update server is now cryptographically signed, and both the signature and certificate will be verified before any updates are applied.<\/p>\n

\"Fixed
Fixed in Notepad++ v8.9.2 (source : notepad-plus-plus.org)<\/figcaption><\/figure>\n

This means that, starting with v8.9.2, all future updates will only be accepted if they are verified against trusted Notepad++ certificates.<\/p>\n

In addition to this measure, Notepad++ now performs two independent verifications forming what the developers describe as a\u00a0\u201cDouble-Lock\u201d update system:<\/p>\n

\n\n\n\n\n\n\n
Verification Layer<\/th>\nSource<\/th>\nVersion<\/th>\nPurpose<\/th>\n<\/tr>\n<\/thead>\n
XML Signature Verification<\/strong><\/td>\nNotepad++ official site<\/td>\nv8.9.2<\/td>\nVerifies signed update metadata (XML) to prevent tampering or spoofed update info.<\/td>\n<\/tr>\n
Installer Signature Verification<\/strong><\/td>\nGitHub<\/td>\nv8.8.9<\/td>\nValidates installer digital signature to block modified or malicious binaries.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Together, these measures create a resilient security model that prevents malicious interception or tampering of update files. The development team notes that this design effectively makes the update process \u201crobust and unexploitable.\u201d<\/p>\n

WinGUp Auto-Updater Enhancements<\/strong><\/h2>\n

The\u00a0WinGUp auto-updater, which manages update downloads and installations, has also undergone a significant security overhaul.<\/p>\n

Key improvements include:<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n
Category<\/th>\nImprovement<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
Update Security<\/strong><\/td>\nXMLDSig signing<\/td>\nUpdate XML files from Notepad++ server are digitally signed for integrity verification.<\/td>\n<\/tr>\n
Double Verification<\/strong><\/td>\nDual update validation<\/td>\nSigned XML (official site) + signed installer from GitHub.<\/td>\n<\/tr>\n
Certificate Enforcement<\/strong><\/td>\nStrict signature checks<\/td>\nCertificates validated before updates install.<\/td>\n<\/tr>\n
Auto-Updater Hardening<\/strong><\/td>\nRemoved libcurl.dll<\/td>\nEliminates DLL side-loading risk.<\/td>\n<\/tr>\n
Stronger SSL<\/strong><\/td>\nDisabled weak cURL options<\/td>\nEnforces stricter TLS\/SSL validation.<\/td>\n<\/tr>\n
Plugin Control<\/strong><\/td>\nSigned plugins only<\/td>\nOnly plugins signed with official certificate allowed.<\/td>\n<\/tr>\n
Stability & Transparency<\/strong><\/td>\nBug fixes + public response<\/td>\nImproves stability and maintains open communication post-incident.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Moreover, users who prefer manual update control can\u00a0turn off the auto-updater during installation\u00a0or use the MSI parameter:<\/p>\n

msiexec \/i npp.8.9.2.Installer.x64.msi NOUPDATER=1<\/code><\/pre>\n
Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n
The post Notepad++ v8.9.2 Released with \u201cDouble-Lock\u201d Update Mechanism Following Recent Hack<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Notepad++ v8.9.2 Released with \u201cDouble-Lock\u201d Update Mechanism Following Recent Hack The widely used open-source text and code editor has released version\u00a0v8.9.2, introducing a major security enhancement known as the\u00a0\u201cDouble-Lock\u201d update mechanism. This update addresses vulnerabilities that were exploited in a recent state-sponsored attack\u00a0targeting the application\u2019s update infrastructure. Last month, Notepad++\u2019s official site confirmed that attackers […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648],"tags":[130],"class_list":["post-10740","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10740"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10740"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10740\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}