Notepad++ Suffers Hosting Breach, China-Linked Lotus Blossom Group Suspected

In early February 2026, major cybersecurity reports revealed that the popular open-source text editor Notepad++ was the target of a sophisticated supply-chain breach that lasted for approximately six months. The incident exposed weaknesses in the application’s hosting and update infrastructure, enabling attackers to intercept and redirect update traffic from certain users and deliver malicious software.