The issue is not new, because it's from December 2025, but over the weekend I worked on Notepad++ only on my private computer. Who knows this program, knows what its advantages are over a similarch editors, and in particular to the standard Notepad.
At a glance – A state-run hacking group (attributed to China, e.g. Lotus Blossom / Zirconium) has taken over part of the Notepad++ update infrastructure to hijack updates and provide „enriched” installers to selected users. Info from Notepadd++ here: Notepad++ Hijacked by State-Sponsored Hackers | Notepad++
Large organizations live under constant pressure because they have hundreds of similar items: editors, plug-ins, libraries, small tools from niche vendors, scripts, automations, drivers. Each of these is a potential input. And some of them update „quietly,” often never.Such problems also spill over to their suppliers, e.g., companies that manage their infrastructure, provide software, or even companies that, by virtue of business relationships, do something and need accounts inside our systems.
And here begins a topic that is increasingly coming back in meetings with customers: risk analysis and supply chain risk. I see that this is not an academic discussion, because every now and then situations like this come up, a Customers ask about very mundane things:
- Which applications and vendors are really critical,
- What happens if one „small” tool is seized,
- How quickly we detect it,
- How much it can cost (time, downtime, penalties, data loss, reputation).
- or at least where and what is with all these AI systems
Therefore, I encourage: it is useful to understand what risk analysis is and what is risk qualification, quantification of risk (risk quantification).
Risk analysis helps you lay out the topic in your head and on a map: what we have, where the weakest place is, what is most likely to happen and what hurts the most. You can qualify, disqualify suppliers.
Risk qualification goes a step further: it tries to convert risks into money and priorities. This makes it easier to talk to management and decide what we do first and what can wait.
Because sometimes a „trivial” thing, like a word processor, is a direct reminder: the security of an organization is the sum of the little things, and usually something catches fire.And someone will always try to hit precisely those little things.