• FAQ: February Security Announcement

    Pinned until 3/1/26, 9:17 PM Locked Security
    4
    2 Votes
    4 Posts
    905 Views
    PeterJonesP

    Updates with new clarifications from this comment:

    Target Information

    Kaspersky only saw evidence of victims IP addresses in Vietnam, El Salvador, Australia and the Philippines, and noted, “We observed three different infection chains overall, designed to attack about a dozen machines…”.

    Thus, it wasn’t just “targeted” – out of all the update attempts that would have happened during the June to December timeframe, it appears there were only a dozen victims: everyone else got a normal, unaffected update, with no malicious payload.

    Obvious Side-effect: Notepad++ Not Actually Updated after “Update”

    When the attackers redirected victims, the victims got “updaters” which did nothing to notepad++.exe. If every time that automatic updates ran, you saw Notepad++ actually updated, you were not one of the victims.

    In case the user runs Notepad++ updater, if the version remains exactly the same after the attempted update, the user can check %LOCALAPPDATA%\Notepad++\log\securityError.log to see what happened & report it.

  • 0 Votes
    16 Posts
    368 Views
    guy038G

    Hello, @mark-boonie and All,

    I said in this post that we can translate the regex’s logic to :

    What_I_do_not_want(*SKIP)(*F)|What_I_want. See also the excellent article, on this topic, at https://www.rexegg.com/backtracking-control-verbs.php#skipfail !

    But, regarding your present example, @mark-boonie, I suppose that we should invert the logic and tell :

    What_I_want_to_keep(*SKIP)(*F)|What_I_want_to_delete

    This means that any multi-lines block, with delimiters Block start and Block end containing the string 80     00010000 is not considered ( text is skipped ) and that any single line contents, with its line-break, due to the (?-s) modifier, must be deleted

    Note that the use of the Backtracking Control Verbs (*SKIP) and (*F) is not mandatory at all ! we could have used this syntax, instead, for similar results :

    SEARCH (?s)^\*Block start\h*((?!\*Block start).)+?80 00010000.+?^\*Block end\h*\R?|(?-s)^.*\R?

    REPLACE (?1$0)

    We simply change the non-capturing group (?:(?!\*Block start).)+? into a capturing group ((?!\*Block start).)+?

    We tell that, in replacement, we must rewrite any block entirely ( $0 ), if the group 1 exists, thus the (?1$0) syntax

    And, as there is no colon char and text after (?1$0, nothing must be taken in account if the group 1 is absent, which is the case in the (?-s)^.*\R? part !

    Best regards,

    guy038

  • 0 Votes
    2 Posts
    98 Views
    David Smith 2D

    This issue has been fixed:
    I did the following. As I use a inline style sheet I created a “css color.css” file in Notepad++. Just a blank page that I can do the following:

    I can now paste my HTMLPad 2025 css code into Notepad++ with the colors I changed under Settings> Style Configurator.

    I also created a “html-colors.html” blank file and I can copy the html code with colors that Notepad++ provides that has been updated in the Style Configurator.

    Next I highlight the text then go to “Plugins” on the toolbar then “NppExport” then “Copy all formats to clipboard”.

    I can now paste in the html/css code into Word with the colors I want.

    I still cannot create a style in Word 2024 with colors as I suspect it would be too complicated for Word to figure what parts the different text it should color.

  • Session migration

    General Discussion
    2
    0 Votes
    2 Posts
    94 Views
    PeterJonesP

    @Magic-Mugs ,

    Assuming all your open files are real files, and all in the exact same folders on old and new machine, then just copy over %AppData%\Notepad++\session.xml

    If some of your files are the unsaved new # tabs, you will also need to copy over everything in %AppData%\Notepad++\backup\

    But if you want all the same settings from your old to your new, just copy over everything from %AppData%\Notepad++\

  • 0 Votes
    2 Posts
    186 Views
    PeterJonesP

    @nikkinisly ,

    The thing truly named “Plugin Manager” was last compatible with Notepad++ in v7.5.9 from October 2019. Had you really not updated since then?

    Or are you talking about Plugins Admin? That’s the builtin replacement since v7.6 in November 2019

    And it’s still in v8.9.1:
    0e15144b-967e-42d8-a505-a19330607d00-image.png

    My guess is that you deleted gup.exe and/or other of the content in the updater folder, or the plugin list DLL. To find out:

    Exit Notepad++ Perform steps 1-3 for each of the following files List of files C:\Program Files\Notepad++\notepad++.exe C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll C:\Program Files\Notepad++\updater\GUP.exe C:\Program Files\Notepad++\updater\libcurl.dll If any of those files are missing, you will need to reinstall, making sure to include the auto-updater and Plugins Admin, because all of those files are required for Plugins Admin to work Steps Right click on the file and choose Properties Look to see if it still has the Unblock checkbox If it does, checkmark it, then click Apply / OK

    here is an example of a GUP.exe that still has the mark of the web:
    9baed526-5a1a-4497-a75b-1acdc23f3b85-image.png

    After making sure the Mark of the Web is gone from all those files, then restart Notepad++, and Plugins Admin should be there.

  • 0 Votes
    5 Posts
    285 Views
    PeterJonesP

    @PeterJones said in Is There a Way to Prevent Pasted Text from Spreading Out with Rows of Spaces?:

    implementing it in PythonScript today

    Thankfully, I found an old script which did something related, which was easy to update.

    # encoding=utf-8 """in response to https://community.notepad-plus-plus.org/topic/27385/ This will paste the CF_TEXT plaintext from the clipboard, but will convert any series of newline characters into a single space before doing the paste. Because this uses .insertText() instead of putting the modified text back into the clipboard and doing .paste(), it should avoid clobbering the clipboard. (based on @alan-kilborn's clipboard script here: <https://community.notepad-plus-plus.org/post/97132>) """ from Npp import * try: editor3h # third editor, hidden except NameError: editor3h = notepad.createScintilla() def get_clipboard_text_without_newlines(): retval = '' editor3h.clearAll() editor3h.paste() if editor3h.getLength() > 0: editor3h.rereplace(r'[\r\n]+', ' ') # replace all newline seqeuences with a single space retval = editor3h.getText() return retval editor.beginUndoAction() editor.insertText(editor.getCurrentPos(), get_clipboard_text_without_newlines()) editor.endUndoAction()

    This has been tested in the PythonScript 3 plugin. The PythonScript FAQ explains how to install PythonScript plugin, and how to run a script using PythonScript plugin, and even how to assign a keyboard shortcut to the script. Make sure you follow the instructions for PythonScript 3, not PythonScript 2 (as I have not tested under the older plugin syntax, though it will likely work there)

  • Strange highlighting in PHP files

    General Discussion
    3
    0 Votes
    3 Posts
    196 Views
    Nazar HotsaN

    Thank you! Problem solved.

  • 0 Votes
    2 Posts
    106 Views
    EkopalypseE

    @Jay-S

    I replied here.

  • 1 Votes
    2 Posts
    285 Views
    shane knappS

    @David-Brown i came here to let you know that my receipt had what appears to be his email address on it (which i’ve blocked out here for privacy):

    2a1a9747-0e42-4d15-80d0-eb4737ffabd4-image.png

    seems legit to me, but i can’t know for sure. :)

  • 0 Votes
    2 Posts
    235 Views
    PeterJonesP

    @Ilhan-Yumer ,

    The developer does not read most posts in this Forum. If you would like to suggest such a move to the developer, I would recommend creating a new Issue at GitHub requesting it (https://github.com/notepad-plus-plus/notepad-plus-plus/issues).

  • Chinese compromise began as early as NP++ v8.6.9

    Locked Security
    4
    0 Votes
    4 Posts
    688 Views
    PeterJonesP

    Future readers: if you want more information for the context of this discussion, See the FAQ, which has the best summary I can make, as of 2026-Feb-04; if new information is available, the FAQ will be updated. ALL followups/discussions must go in Topic: autoupdater and connection to temp.sh. This tangent is LOCKED.

  • I am very confused about the Notepad++ security issue

    Locked Security
    3
    0 Votes
    3 Posts
    386 Views
    PeterJonesP

    See the FAQ, which has the best summary I can make, as of 2026-Feb-04; if new information is available, the FAQ will be updated. ALL followups/discussions must go in Topic: autoupdater and connection to temp.sh. This tangent is LOCKED.

  • 1 Votes
    3 Posts
    280 Views
    PeterJonesP

    See the FAQ, which has the best summary I can make, as of 2026-Feb-04; if new information is available, the FAQ will be updated. ALL followups/discussions must go in Topic: autoupdater and connection to temp.sh. This tangent is LOCKED.

  • 0 Votes
    2 Posts
    188 Views
    Jan LarsenJ

    Turns out it was an issue with the GPU driver, which has now been patched.

  • 0 Votes
    11 Posts
    6k Views
    Ahmad IqbalA

    @archerarcher1 I will suggest LongPathTool to solve this error.

  • Advices to prevent further security vulnerabilities

    Moved Security
    4
    0 Votes
    4 Posts
    524 Views
    NppenjoyrN

    BTW:

    5.1-if your home internet speed is fast enough, setup your own web server to your pc under virtualbox(in case of web server software cve’s/rce’s). I or anyone can help with that. Dont forget to hardening server for security.

    IMO, this is BAD advice. To suggest to a non-security specialist who runs this as a hobby, that he should self-host, and try to keep up on all the security hardening, is asking him to get hacked even worse than the hack that already happened. He was literally paying a host to provide such services, and the professionals failed; he has now changed providers to a host who has better security procedures.

    Believe me it’s not that hard to setup a webserver or harden it, especially while backed by a strong community. The risks are different when hosting at home between hosting remotely. The hosting firm may be offered money to hijack, or an out-of-date hosting management software had rce was waiting to be abused.

  • Tab bar tab width

    Help wanted · · · – – – · · ·
    3
    0 Votes
    3 Posts
    183 Views
    A

    @PeterJones
    on the screenshot above Reduce option is already pressed though.
    Max tab label length truncates text, which is not the behavior i want to restore - i want the tabs with short names to not have this big gap at the end.

    That said, it seems that the “enable pin tab feature” was the culprit, as disabling it seems to have restored the desired tab size behavior.

    There still is some extra spacing before the close button though:

    2bb5dad1-4a85-4bd0-8df8-768e93562693-image.png
    629bde33-102c-4a09-a960-60ded9dcd809-image.png

  • About recent security flaws

    Help wanted · · · – – – · · ·
    2
    0 Votes
    2 Posts
    253 Views
  • Notepad v8.8.2 32-bit installer: virus or malware detected

    Security
    4
    0 Votes
    4 Posts
    8k Views
    PeterJonesP

    @Tavi ,

    As far as I can tell, they were unrelated. Scanners such as VirusTotal look at the executable itself, and last year were being triggered by the lack of signing and the self-signing of the executable.

    please confirm if this issue is related to the notepad++ hijack news dated 2nd Feb 2026?

    The issue you are referring to, as linked here and described in detail here specifically said,

    the compromise occured at the hosting provider level rather than through vulnerabilities in Notepad++ code itself.

    This was a website hack, and VirusTotal and other such AV scans do not detect website hacks, as far as I understand them.

    See the FAQ, which has the best “table of contents” for the website hack. ALL related followups/discussions must go in Topic: autoupdater and connection to temp.sh.

  • WHEN GOOGLE IS POSSESSED BY PROFIT

    Pinned Announcements
    23
    6 Votes
    23 Posts
    21k Views
    donhoD

    It seems that malicious ads (promoting a fake Notepad++ website) have returned on the Google search page.
    Below is the email I received this morning:

    Hi Don
    I am a long-time user and admirer of Notepad++. I am based in Australia.

    Today, I went to download a copy of Notepad++ to a new machine. When I searched for “Notepad++” in Google, the first link which came up appears to be a FAKE website located in China:

    https://www[.]notepadplus[.]com[.]cn/en/

    I thought I should let you know, in case this is some kind of hacking attempt.

    Any follow up questions, just let me know.

    Kind regards

    If anyone here has encountered these malicious ads, please use the following link to report them to Google:
    https://support.google.com/ads/troubleshooter/4578507?visit_id=639056285883908601-3926234762&rd=1