provider, the shared hosting server was compromised until September 2, 2025," Ho explained. "Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious