Category: Security & Privacy

Why You Need to Update Notepad++ Immediately

Posted on by Martin Brinkmann

The popular open source plain text editor has become the target of state-sponsored hackers, according to a blog post. The Notepad++ developer released a detailed post-mortem on a severe supply chain attack that occurred between June and December 2025.

By compromising the application’s hosting provider, state-sponsored hackers were able to redirect update traffic to serve malicious files to users of the text editor.

It all started in 2025

When the developer of Notepad++ put out a security warning in December 2025, it was immediately clear that something critical happened. The blog post confirmed that a vulnerability of the updating process had been exploited for some time. Traffic “was occasionally redirected to malicious servers”, which resulted “in the download of compromised executables” according to the message.

The developer released Notepad++ 8.8.9 to address the issue. That version had been hardened according to the report by adding verification steps to the update process. In other words, Notepad++ checks whether the signature and the certificate of the downloaded installer (the new version) check out. If they do not, updating is aborted.

New information comes to light

The latest version of Notepad++ is 8.9.1 at the time of writing.

Today, a new blog post was published that provides detailed information on the incident. Here are the details:

  • The Breach Method: The attack was not a vulnerability in the Notepad++ code itself, but a compromise of its hosting provider’s infrastructure.
  • The Timeline: The hijacking occurred over a six-month period, starting in June 2025 and lasting until it was discovered and shut down on December 2, 2025.
  • State-Sponsored Attribution: Security researchers (including those from HarfangLab and ESET) linked the activity to “Taidoor,” a malware strain associated with Chinese state-sponsored threat actors.
  • Targeted Delivery: The attackers used a “Man-in-the-Middle” tactic via the WinGUp updater; however, they did not target every user, instead selectively delivering malicious updates to specific IP addresses or regions.
  • Infrastructure Migration: In response, Notepad++ has completely abandoned its previous hosting provider and migrated all binaries and update manifests to a new, more secure infrastructure.
  • Enhanced Security Measures: To prevent future incidents, new versions include mandatory signature verification and certificate pinning for all automated updates.
  • User Action Required: Users are urged to ensure they are running the latest version of Notepad++ and to be wary of any version installed or updated between the June and December window.

The latest version is Notepad 8.9.1. You can download it from the official website to make sure that a potentially compromised version is replaced.

You can check the installed version by opening Notepad++ and selecting ? > About Notepad++, or by pressing F1.

It’s Change Your Password Day (again): Here is Why You Should Probably Do Nothing

Posted on by Martin Brinkmann

Today is officially “Change Your Password Day”, a special day designed to put cybersecurity top of mind. But before you rush to update your logins, pause for a moment: experts now warn that changing your password simply for the sake of the calendar might actually hurt your security more than it helps.

The idea behind the day is simple: Every year, go through your list of accounts and passwords, and change them. Why? The original logic behind the day dates back to a time when modern threat detection and additional layers of account protections did not exist.

Changing passwords frequently could disrupt brute force attempts, silent breaches, or accidental leaks. While that did make sense in some cases back in the days, it is seen as hurting more than it helps in most cases today. Even back then, it caused all kinds of inconveniences, for instance, when on the next day of work, employees starting to make calls to the IT department, because they could not get into their accounts anymore.

In fact, experts suggest that password should only be changed in very specific circumstances, such as:

  • Re-use of passwords across multiple sites, as it goes against the “one site, one unique password” recommendation.
  • Weak passwords, as todays computers can break into these in seconds or minutes.
  • Breached passwords, which is self-explanatory
  • When someone else might have access.

However, it is recommended to act immediately instead of waiting for password-day to come along.

This day, at best, is a reminder for users to look at their passwords and start changing the weak, leaked, or re-used ones immediately. While at it, it is recommended to set up another layer of protection, for instance two-factor authentication, for important accounts.

Here is why most security experts advise against frequent password changes: In many cases users pick easy to remember passwords, especially in organizations. The reason is simple: lack of a password manager requires that users remember the passwords. With frequent changes, this becomes a nuisance. Employees started to iterate passwords to help their memory, while others wrote them down to avoid having to contact the IT department to get the password reset ever so often.

The Modern Security Checklist

  • Run a check for data breaches. Go to HaveIBeenPwned.com (or use your password manager’s security dashboard) to see if your email or passwords have appeared in a known data leak. Change only the compromised ones immediately, including on other sites if the password was re-used.
  • Audit your passwords: Check for the following:
    • Password length: Too short means weak. Aim for at least 16 characters.
    • Password re-use: All passwords should be unique. If one gets breached, hackers only gain access to one account, not several.
    • Remove the ghosts: If you do not use an account anymore, close it.
    • Second layer: Consider Adding two-factor authentication or other means of protection to important accounts.
    • Check recovery options: Make sure email addresses or phone numbers are set correctly, backup codes stored securely, in case of an emergency account recovery.

The era of Tr0ub4dor&3 is over. In 2026, the best gift you can give your digital self is length, uniqueness, and a second layer of defense. So, celebrate “Change Your Password Day” the modern way: upgrade your security once, do it right, and then go enjoy the rest of your Sunday knowing your digital life is locked tight.

Total Opt-Out: How to Use Firefox 148’s New Master Switch to Block All AI Features

Posted on by Martin Brinkmann

In an era where tech giants are racing to weave artificial intelligence into every corner of the browsing experience, Mozilla is handing the controls back to the user.

In a few weeks, the organization plans to launch Firefox 148 to the stable channel. It will include the “AI kill switch” that Mozilla executives hinted at earlier. With it, users of Firefox may block existing and new AI features in the browser either entirely or selectively.

Support of AI features

Firefox supports several AI features at the time off writing. This includes the option to interact with AI chatbots in the sidebar, get link preview summaries and tab suggestions, or help with tab group labeling.

In summary (as of Firefox 147):

  • Translations
  • Image alt text in Nightly PDF viewer
  • Tab group suggestions
  • Key points in link previews
  • Chatbot providers in sidebar

Not all features are available for all Firefox users. Some are limited to users who use the open source browser in English.

A detailed look at Firefox’s AI Kill Switch

The new AI Controls page of the Firefox Settings.

Starting in Firefox 148, out next month and available as a preview already, Firefox will include the option to block AI functions.

Mozilla added an AI Controls section to the preferences of the browser. You can launch Menu > Settings > AI Controls, or load about:preferences#ai directly to manage AI features in the browser.

Note: The preference browser.preferences.aiControls controls the entry in the preferences. Toggle it to True to enable it, or to False to disable it. This impacts only the display in Settings.

Firefox includes an option to disable all AI features with a single preference.

How to disable all AI in Firefox? Just toggle “Block AI enhancements” to Off. You get a prompt that explains what is going to happen. Activate “block” here to disable all AI features in the browser.

Instead of blocking everything, Firefox users may also block specific features only.

The AI Controls page divides the functions into two sections: On-device AI and AI chatbot providers in sidebar.

Each AI feature is listed with its name, a short description, and an action button. You can switch a feature from “Available” or “Enabled” to “Blocked”.

  • Available means that it can be used, but has not been up until now.
  • Enabled means that the user opted-in to use the AI feature.
  • Blocked that it is not active in the Firefox browser.

Here are the features that you can manage individually right now:

  • Translations
  • Image alt text in Nightly PDF viewer
  • Tab group suggestions
  • Key points in link previews
  • Chatbot in sidebar

Closing Words

Ultimately, Mozilla’s introduction of a global block toggle for all AI features highlights the organization’s awareness of the deep-seated skepticism toward AI among its user base. With it, it is giving Firefox users control over AI. Those who do not want it can make sure that it is disabled entirely in the browser, while everyone else may keep some or even all AI features enabled to make use of them.

By providing a clear, centralized way to opt out of AI—and ensuring that local data is purged when those features are disabled—Firefox 148 sets a high standard for how browser developers should respect individual choice. (source: Sören Hentzschel)

Google Chrome Gets a Major Upgrade with Gemini 3 and Auto-Browse

Posted on by Martin Brinkmann

Google is officially transforming the web browser from a static tool into an active personal agent with the launch of Gemini 3 and “Auto-Browse” in Chrome, and the push into a personalized AI experience.

Announced yesterday for desktop users, with the exception of Chrome for Linux, this major update integrates Google’s most advanced AI model directly into the browser to handle complex, multi-step tasks.

Google is pushing Gemini with the help of its Chrome browser

Lookout OpenAI, Gemini could get a massive user boost thanks to the integration in the world’s biggest browser.

Here is an overview of the features that Google announced:

Auto-Browse (Agentic Browsing): The flagship feature for AI Pro and Ultra subscribers in the U.S. that performs multi-step “chores” on your behalf. It can research travel costs across dates, fill out complex online forms, file expense reports, or add specific items to a shopping cart based on an image.

Gemini Side Panel: A persistent area in Chrome that supports interactions with the AI without losing focus. It supports the usual AI-features, such as summarizing a page, comparing features across several tabs, or finding time in your calendar.

Integrated “Nano Banana”: The latest version of Google’s image generator is integrated into the browser. Also accessible from the side panel, you can use text prompts for creative tasks, such as turning research data into infographics or manipulating images open in the browser.

Connected Apps Integration: Deeper connectivity with the Google ecosystem, allowing Gemini to pull information from Gmail, Calendar, Maps, and Google Flights to execute workflows (e.g., finding a flight based on an event invitation in your email).

Personal Intelligence: A proactive feature that remembers context from past conversations to provide tailored answers. It learns user preferences over time to transform the browser into a “trusted partner” rather than a general-purpose tool.

Universal Commerce Protocol (UCP) Support: Integration with a new open standard (co-developed with brands like Shopify and Wayfair) that allows AI agents to navigate checkout processes and take commercial actions across different retail sites securely.

Enhanced Security & “Pause and Confirm”: New defenses designed for agentic AI, including a safety mechanism where Auto-Browse must pause and ask for explicit user confirmation before completing sensitive actions.

Closing Words

It is clear that Gemini will get a huge user boost from this. Even if Google limits exposure to certain regions or subscription models at first, it is clear that it will expose as many users as possible to Gemini in Chrome in the long run.

Why? Because it is giving Google an edge over the competition. Plus, when users run into usage limits, they may become paying subscribers, which seems to be on the preferred options right now to increase revenue and compensate expenses.

The benefit for users invested in Google’s ecosystem is there, especially if you connect the AI to other Google services. Whether you really want that, an all-knowing AI that may know more about your desires, life and plans than your closest friends, is up for you to decide.

I see the benefits, but also the dangers. While I do use AI tools for some tasks, such as creating a teaser image for an article here or the weekly newsletter, I do not really see a benefit in letting AI do the shopping for me, even with all safeguards in place.

The Long Tail of CVE-2025-8088: How One WinRAR Flaw Outlived Its Patch

Posted on by Martin Brinkmann

It has been over six months since Rarlab released a fix for the critical WinRAR vulnerability known as CVE-2025-8088, but attacks continue to target it as if the patch was released just days ago.

Despite a patch being available since August 2025, Google Threat Intelligence reports that state-sponsored actors and financially motivated hackers are still finding immense success targeting users who have neglected to hit the update button.

This “long tail” of exploitation serves as a stark reminder that a vulnerability doesn’t disappear just because a solution exists.

Key Information:

DetailUpdated Information
Vulnerability IDCVE-2025-8088
Patch StatusAvailable for 6+ months
Primary ThreatState-sponsored and financially motivated actors
Action RequiredEnsure WinRAR is updated to the latest version

When Rarlab released WinRar 7.13 to patch the security vulnerability back in July 2025, barely anyone thought that this security issue would remain a problem six months later.

A report by Google security researchers suggests that the issue is still exploited actively. It appears that a percentage of WinRar users have not patched the archiving software yet.

Google found out that attacks originate from several countries, including Russia and China. To exploit the issue, attackers need to create a specially prepared RAR archive. When a victim unpacks the archive, malicious files are moved to the autostart of the system for execution.

Google writes:

CVE-2025-8088 is a high-severity path traversal vulnerability in WinRAR that attackers exploit by leveraging Alternate Data Streams (ADS). Adversaries can craft malicious RAR archives which, when opened by a vulnerable version of WinRAR, can write files to arbitrary locations on the system.

The issue affects WinRar and also related apps and files, including unrar.dll. However, the issue affects RAR on Windows only. Other operating systems with RAR apps, including Linux and Android, are not affected by the issue.

How to protect your systems

It is necessary to update WinRar or any of the other Rar tools affected by the issue, to the latest version. Windows users need to install WinRar 7.13 to protect their devices. Downloads are provided on the official Rarlab website.

Just download the latest release and run the installer to update the application. Installation of WinRar 7.20 Beta will also resolve the issue, but since it is a beta release, it is not recommended to run it on most PCs.

The OLE Overlook: High-Stakes Security Bypass in Microsoft Office (CVE-2026-21509)

Posted on by Martin Brinkmann

The “trust but verify” era of document security has been blindsided by a sophisticated new threat that turns Microsoft’s own integration features against the user.

This week, Microsoft disclosed a critical zero-day vulnerability, CVE-2026-21509, which allows attackers to bypass core Object Linking and Embedding (OLE) security mitigations within the Microsoft Office Suite.

The flaw is actively exploited in the wild, affects most versions of Office, and allows malicious actors to execute unauthorized code when a victim opens a compromised file.

The essentials

  • Name of vulnerability: Microsoft Office Security Feature Bypass Vulnerability
  • Severity: Important
  • ID: CVE-2026-21509
  • Affected Software: Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise

Microsoft has a solution for the issue that is applied automatically in some cases and requires an update in others.

In short: If Office 2016 or 2019 is used, an update is required to patch the vulnerability. All newer versions of Office do not require an update, as Microsoft is adding the protection using a service-side change. However, Office needs to be restarted before this protection is applied.

Downloads, if necessary, are provided on the official Update Guide website linked above (under ID).

Microsoft published mitigations as well, but these are not really required, unless updates can’t be installed immediately. The mitigations require Registry edits and as such a restart before they protect the application from potential exploits.

WhatsApp Premium? New Leak Reveals Meta’s Plan to Launch Ad-Free Subscriptions

Posted on by Martin Brinkmann

Ever since its inception, the world’s most popular messaging app has retained the status of an ad-free, then almost ad-free experience, but that “free” ride is officially reaching a fork in the road. WhatsApp is reportedly preparing to launch a paid membership tier this year starting with users in Europe to allow them to bypass the advertisements currently rolling out across the platform.

As Meta looks to monetize the “Updates” tab, this new ad-free subscription marks the first time in history that users may have to pay to keep their messaging experience clean.

This move is not happening in a vacuum. WhatsApp, owned by Meta, is following the exact strategy that Meta deployed for Facebook and Instagram across Europe. Under the model, users are asked to make the following choice: either allow Meta to track their activity for personalized advertisement or pay a monthly fee to keep the feed clean.

While Meta is copying the base strategy directly from Facebook and Instagram, WhatsApp’s personal chats remain ad-free, at least for now. This means that users pay Meta to keep the Status and Channels sections ad-free and stop creating an advertising profile of users who pay the premium.

What happens if you don’t pay?

Personal chats remain free of advertisement, at least for now. This is something that Meta has shied away from as it would like drive users towards competitors like Signal or Telegram.

Users who do not subscribe will continue to see sponsored content in the “Updates” tab.

The Verdict: Is WhatsApp Premium Worth It?

ProsCons
Clean Interface: Removes intrusive banners and sponsored posts from the Status and Channels tabs.New Monthly Expense: Adds to “subscription fatigue” for an app that has been free for over a decade.
Data Privacy: Meta may not create a profile for advertising, since there are not any ads to show.Partial Solution: Early reports suggest ads remain in “Channels” you don’t follow, so it may not be 100% ad-free.
Early Access: Potential for premium-only features, such as larger file sharing or advanced chat organization.Limited: Meta may limit the ability to pay to avoid ads to certain countries, similarly to how it handles this on Facebook and Instagram.

As the line between personal messaging and social media continues to blur, WhatsApp’s transition into a “freemium” service feels like the end of an era. For now, the core of WhatsApp, private conversations between users, remains untouched and ad-free.

However, now that the infrastructure is in place, Meta might consider pushing ads more aggressively on WhatsApp.

Google wants to personalize your search experience even more, but needs your data for that

Posted on by Martin Brinkmann

Imagine if Google Search didn’t just know the internet, but actually understood your context. Scary? Wonderful?

Google is making this a reality for AI Pro and Ultra subscribers with the launch of Personal Intelligence in AI Mode, a new feature that lets you securely connect Gmail and Google Photos directly to your search results.

This update is designed to save your time by transforming — often — generic search queries into personalized answers while ensuring your personal data remains private, opt-in, and strictly under your control, according to Google.

Announced yesterday, Google continues to push a personal angle into its products. Last week, Google introduced Personal Intelligence that connects its Gemini AI with Gmail, YouTube and some other company services.

This week’s announcement extends Personal Intelligence to Google Search. More precisely, to AI Mode of Google Search.

Personal Intelligence in AI Mode for Search

What it does: It connects Gmail and Google Photos to the AI Mode of Google Search. This allows Gemini to cross-reference information from emails or photos with general search information to provide answers that are specific to the user.

For example, if you ask for an itinerary, it may look up flight or accommodation information in Gmail as well as what you liked to do in past holidays on Google Photos to suggest an itinerary that is personalized.

Who gets it: The feature is rolling out as a Labs experiment. It is only available for Google AI Pro and AI Ultra subscribers in the United States who search in English.

What about privacy? The feature is strictly opt-in. Google claims that it is not using any personal data for training and users may disconnect the feature from Search at any time to end it.

Google’s ultimate goal is to bridge the gap between a search engine that knows “the world” and its users. For some, it is a new level of convenience that makes searching on Google better and faster. For others, it is a nightmare come true.

However, since the feature is opt-in and limited to Google AI Pro and Ultra subscribers, the latter camp is likely very small at this point. This could change with a general rollout to non-paying Google Search users.

The success of the feature will ultimately hinge on trust, not so much on the technology and its effectiveness. While Google implemented important guardrails, including making the feature opt-in and promising that personal emails or photos won’t be used for training, handing over the keys to private memories and information requires a huge leap of faith, especially considering that Google’s main line of business is advertisement.

No More $10 Plan: Bitwarden Hikes Prices to Fund ‘Proactive’ Defense Features

Posted on by Martin Brinkmann

For years, Bitwarden held the undisputed title of the tech world’s best password manager bargain, offering top-tier password security for just $10 a year. But that era officially ended today.

In a major strategic shift, the open-source company announced an immediate price increase that sees its individual Premium plan rise to $1.65 per month—effectively doubling the annual cost—while the Families plan climbs to $3.99 per month.

Here is the old and new price comparison.

Old PriceNew Price
BasicFreeFree
Premium$1 per month
$10 per year		$1.65 per month $19.80 per year
Family$40 per year$3.99 per month
$47.88 per year
  • The free basic plan remains as is.
  • Premium nearly doubles to $20 per year.
  • Family increases by about $8 per year.

The company argues the hike is necessary to fund a transition from passive storage to “proactive” defense, rolling out new features like real-time vault health alerts, expanded encrypted storage, and an upcoming phishing blocker designed to stop attacks before they happen.

Here is an overview of the new security features that Bitwarden announced:

Real-Time Vault Health & Coaching

The new feature automates the security process of checking for weak or exposed passwords.

  • In-Vault Alerts: Bitwarden shows a risk-icon next to vault items if a password is weak, reused, or was found in a breach.
  • Password Coaching: The moment a user logs in a site with a weak or compromised password, Bitwarden will prompt them to change it and guide them through the process.

Phishing Blocker

Upgrades defenses against phishing attacks.

  • Proactive Blocking: Bitwarden will attempt to discern legitimate from phishing websites in order to block the latter before filling any credentials.
  • Protection Layer: Aims to stop credential theft before it happens.

Expanded Encrypted Storage

Bitwarden Premium and Family plan customers get five times more storage space under the updated plans. This gives each user five gigabytes of secure file storage space, which they may use to store digital copies of passports, backup codes, wills, and other sensitive documents or files.

Advanced Two-Step Login options

Here, users get two expansions to existing support:

  • More Hardware Keys: Users may register up to ten hardware keys, e.g., a Yubikey, with Bitwarden. This doubles the old limit of five hardware keys.
  • Passkey Support: Improved support for the password-less authentication standard.

Closing Words

Ultimately, this update signals Bitwarden’s growth from a budget-friendly utility into a comprehensive security suite.

While a 100% price jump may sting long-time loyalists, the new ~$20 annual cost remains nearly half the price of top-tier competitors like 1Password and Dashlane.

Bitwarden is softening the blow with a one-time 25% renewal discount for existing users, but the company is clearly betting that active phishing defense and expanded storage are worth the premium. The days of the $10 vault are gone; users must now decide if they are ready to pay double for a smarter, more protective Bitwarden, or if the service’s robust free tier is effectively all the security they need

Personal Intelligence: Google pivots Gemini towards an all-seeing AI

Posted on by Martin Brinkmann

Artificial Intelligence (AI) has been mostly reactionary up to this point: a user initiates a conversation or asks the AI to do something, and the AI reacts to the input.

AI agents will change that, but they too have limited knowledge. All of this is going to change with Google’s announcement of Personal Intelligence, which sounds like Microsoft’s Recall feature, but on steroids.

It marks a shift towards a deeply integrated AI, including into Android and ChromeOS. Unlike the Gemini app, which is mostly there to provide the user with information or create something for the user, Personal Intelligence is designed to know the user fully to provide a deeply personal experience.

  • When does it start? It is rolling out for Google AI subscribers in the United States already.
  • Opt-in or Opt-out? Personal Intelligence is opt-int.
  • Where can you use it? Across Web, Android, and iOS.
  • How does it work? The AI creates a local database of a user’s life that is based on emails, photos, calendar entries, messages, and application usage. It pulls data from various sources to know as much as possible about a particular user.

Google reveals that Personal Intelligence runs on Gemini Nano v3, which is optimized heavily for running on the neural processing units of Pixel 9 and Pixel 10 series devices. This allows it to process sensitive data on the device without the data leaving it at any stage of the process.

Unlike Gemini App, which is just a chat window for the most part, Personal Intelligence sees what the user sees on the screen. Furthermore, the AI may act on the user’s behalf with other apps.

Potential benefits for users

  • The AI you interact with knows as much about your life as you do, at least when it comes to online activity. You can ask it vague questions using natural language.
  • Personal Intelligence has capabilities to act on information. It can not only retrieve information, but also use information for actions.
  • A proactive context that anticipates needs. It may recommend to leave early if it notices that traffic is heavier than usually, knowing where you will be based on calendar entries.

Potential points of criticism

  • While Google emphasizes that sensitive data remains on the device, giving an AI full access to every pixel on the screen and your entire digital life is problematic, especially considering that Google is an advertising company first and foremost.
  • It remains to be seen how an all-seeing AI impacts a device’s battery life.
  • Even with access to personal data, AI may hallucinate, which means that it may return information that does not exist or run the wrong actions on the user’s behalf.
  • Personal Intelligence is also locked into Google’s ecosystem of apps and services for the most part, as functionality with third-party apps is limited at this point.

Closing Words

With Personal Intelligence, Google is offering an interesting and at the same time frightening proposition: a life that is more and more controlled and managed by AI, and in exchange for that, total access to the life of the user.

For now, users have the key in hand. They do not have to enable Personal Intelligence and when they do not, nothing changes. However, when they do, they will effectively allow Google access to their life, connect the dots, and know more about the user than their closest friends or family members.

I want to hear from you: Is on-device processing enough to earn your trust, or does the idea of Google ‘reading’ your screen still feel like a step too far? Let’s discuss in the comments.