Compromised Software Updates and AI Bug Reports Reshape Security Work
· 2:55:35 · Watch on YouTube ↗
Summary
Security Now examines targeted Notepad++ and ESCAN update attacks, curl’s decision to end bug bounties, AI-discovered OpenSSL flaws, and Apple’s planned cellular location privacy setting.
Key points
- Notepad++ author Don Hoe reported that attackers believed to be Chinese compromised its update mechanism and targeted selected users between June and early December 2025. He recommends manually installing version 8.9.1.
- According to researchers cited in the video, attackers used an ESCAN update server to distribute a malicious reload.exe that blocked further updates, established persistence and downloaded additional payloads.
- ESCAN developers said they isolated the affected infrastructure and reset access credentials. Kaspersky telemetry identified hundreds of machines encountering related infection attempts, primarily in India, Bangladesh, Sri Lanka and the Philippines.
- The curl project ended bug-bounty payments after an influx of poor-quality reports, including AI-generated submissions, but continues to accept valid vulnerability reports.
- Isle said its AI system discovered 12 previously unknown OpenSSL vulnerabilities that were fixed in a security release; the video also cites its claim of five genuine curl vulnerability reports.
- Apple’s planned iOS 26.3 setting limits some precise location information available to supported cellular networks, without changing location data shared with emergency responders or apps.
Article Details
- Topics
- [10:15] AI agent permissions and security tradeoffs
- [24:25] Targeted Notepad++ update supply-chain attack
- [32:45] ESCAN update-server compromise and malware behavior
- [55:45] Apple’s cellular location privacy setting
- [01:08:07] AI-discovered OpenSSL flaws and curl’s bug-bounty closure
MITRE ATT&CK
T1053.005 · Scheduled TaskThe ESCAN attack malware established persistence by creating scheduled tasks, including one named Corell Defrag.T1195.002 · Compromise Software Supply ChainAttackers compromised software update infrastructure to deliver malicious code to Notepad++ and ESCAN users in separate incidents.