erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: February 2, 2026

1 editorial brief and 8 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Notepad++ Updater Hijack: State Actor Served Bad Updates. Organizations that ran Notepad++ before 8.8.9 with the built-in auto-updater during June-December 2025, especially government, financial, telecom and IT service providers in Southeast Asia and Central America.
  • PyPI: 4 critical advisories (langroid, h2o, bambuddy, vllm). Check with pip-audit (or: pip show <package>).
  • npm: 3 critical advisories (locutus, @signalk/set-system-time, @nyariv/sandboxjs). Check with npm audit (or: npm ls <package>).
  • Maven: 1 critical advisory (ai.h2o:h2o-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • Composer (PHP): 1 critical advisory (ci4-cms-erp/ci4ms). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Supply-chain compromise · CVE-2025-15556

Notepad++ Updater Hijack: State Actor Served Bad Updates

Targeting was narrow (about a dozen machines in Kaspersky's telemetry), but any fleet that auto-updated Notepad++ between June and December 2025 should update to v8.9.1+ and check the published IoCs.

Must act: Organizations that ran Notepad++ before 8.8.9 with the built-in auto-updater during June-December 2025, especially government, financial, telecom and IT service providers in Southeast Asia and Central America.

Can relax: Individual users who simply update to v8.9.1 or later; the vendor and researchers say the vast majority of users were never targeted.

  1. Update every Notepad++ install to v8.9.1 or later from notepad-plus-plus.org.
  2. In managed fleets, deploy the MSI without the updater: msiexec /i npp.8.9.1.Installer.x64.msi NOUPDATER=1, and update through your own software distribution.
  3. Check endpoint telemetry for the Rapid7 and Kaspersky IoCs covering July-December 2025.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 8

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 4

Check: pip-audit (or: pip show <package>)

npm 3

Check: npm audit (or: npm ls <package>)

Composer (PHP) 1

Check: composer audit

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>