Remember when Notepad was just… Notepad? A simple text editor nobody asked to be modernized?
Yeah, Microsoft didn’t care either. They bolted on Markdown support and AI features anyway. And now we’ve got CVE-2026-20841. Remote code execution. Via a text file. This is the kind of thing that makes you go “oh come on, really?”
The software itself wasn’t compromised. But the download link was. So if you downloaded it in the last year, you downloaded state sponsored malware.
No. The download link was never compromised. What was compromised was the built-in auto-update feature.