State-backed attackers hijacked Notepad++ update traffic via a hosting provider breach, redirecting users to malicious downloads since June 2025.
A hole in Microsoft Office is being exploited by bad actors, including Russian hackers targeting Ukraine's government.