frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841
176•riffraff•3h ago•95 comments

A Cosmic Miracle: A Remarkably Luminous Galaxy at z=14.44 Confirmed with JWST

https://astro.theoj.org/article/156033-a-cosmic-miracle-a-remarkably-luminous-galaxy-at-_z_-sub-s...
9•yread•1h ago•2 comments

The Feynman Lectures on Physics (1961-1964)

https://www.feynmanlectures.caltech.edu/
322•rramadass•22h ago•79 comments

The Singularity will occur on a Tuesday

https://campedersen.com/singularity
1091•ecto•16h ago•601 comments

Show HN: CodeMic

https://codemic.io/#hn
13•seansh•2d ago•3 comments

Signy: Signed URLs for Small Devices

https://github.com/golioth/signy
20•hasheddan•4d ago•1 comments

Exploring a Modern SMTPE 2110 Broadcast Truck

https://www.jeffgeerling.com/blog/2026/exploring-a-modern-smpte-2110-broadcast-truck-with-my-dad/
103•assimpleaspossi•2d ago•10 comments

Ex-GitHub CEO launches a new developer platform for AI agents

https://entire.io/blog/hello-entire-world/
488•meetpateltech•18h ago•448 comments

CoLoop (YC S21) Is Hiring Ex Technical Founders in London

https://www.workatastartup.com/jobs/90016
1•mrlowlevel•2h ago

The Day the Telnet Died

https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/
344•pjf•11h ago•240 comments

Everything you need to know about lasers in one photo

https://commons.wikimedia.org/wiki/File:Commercial_laser_lines.svg
10•mahirsaid•3d ago•4 comments

Clean-room implementation of Half-Life 2 on the Quake 1 engine

https://code.idtech.space/fn/hl2
384•klaussilveira•22h ago•80 comments

Fun With Pinball

https://www.funwithpinball.com/exhibits/small-boards
85•jackwilsdon•9h ago•8 comments

FAA Halts All Flights at El Paso Airport for 10 Days

https://www.nytimes.com/2026/02/11/us/faa-el-paso-flight-restrictions.html
36•edward•55m ago•16 comments

The Little Learner: A Straight Line to Deep Learning (2023)

https://mitpress.mit.edu/9780262546379/the-little-learner/
155•AlexeyBrin•2d ago•19 comments

Simplifying Vulkan one subsystem at a time

https://www.khronos.org/blog/simplifying-vulkan-one-subsystem-at-a-time
253•amazari•20h ago•165 comments

My eighth year as a bootstrapped founder

https://mtlynch.io/bootstrapped-founder-year-8/
238•mtlynch•2d ago•66 comments

Show HN: I taught GPT-OSS-120B to see using Google Lens and OpenCV

23•vkaufmann•4h ago•13 comments

Communities Are Not Fungible

https://www.joanwestenberg.com/communities-are-not-fungible/
22•tardibear•2h ago•14 comments

Mathematicians disagree on the essential structure of the complex numbers (2024)

https://www.infinitelymore.xyz/p/complex-numbers-essential-structure
203•FillMaths•17h ago•253 comments

Flirt: The Native Backend

https://blog.buenzli.dev/flirt-native-backend/
19•senekor•3d ago•4 comments

Europe's $24T Breakup with Visa and Mastercard Has Begun

https://europeanbusinessmagazine.com/business/europes-24-trillion-breakup-with-visa-and-mastercar...
906•NewCzech•22h ago•763 comments

Willow – Protocols for an uncertain future [video]

https://fosdem.org/2026/schedule/event/CVGZAV-willow/
58•todsacerdoti•3d ago•5 comments

Show HN: JavaScript-first, open-source WYSIWYG DOCX editor

https://github.com/eigenpal/docx-js-editor
95•thisisjedr•1d ago•28 comments

The Falkirk Wheel

https://www.scottishcanals.co.uk/visit/canals/visit-the-forth-clyde-canal/attractions/the-falkirk...
76•scapecast•13h ago•34 comments

Lessons you will learn living in a snowy place

https://eukaryotewritesblog.com/2026/01/21/very-snowy-place/
162•surprisetalk•4d ago•127 comments

Show HN: Rowboat – AI coworker that turns your work into a knowledge graph (OSS)

https://github.com/rowboatlabs/rowboat
162•segmenta•17h ago•39 comments

Rivian R2: Electric Mid-Size SUV

https://rivian.com/r2
116•socialcommenter•8h ago•208 comments

Competition is not market validation

https://www.ablg.io/blog/competition-is-not-validation
110•tonioab•17h ago•31 comments

A brief history of oral peptides

https://seangeiger.substack.com/p/a-brief-history-of-oral-peptides
117•odedfalik•1d ago•42 comments
Open in hackernews

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841
174•riffraff•3h ago

Comments

consp•1h ago
So what this means is every Windows program is now a cve nightmare (or goldmine, depending on view)?
a96•1h ago
Always has been.
veltas•1h ago
Yeah the other day in calc.exe I pressed F7 in programmer mode to change to octal (F5 to F8 select Hex, Dec, Oct, Bin), and instead it asked if I was sure I wanted to enable caret browsing.
balazspapp•46m ago
I've found calc's currency converter feature frightening.
dark-star•1h ago
Yeah, clicking unverified links in a markdown document to launch an executable....

Clicking unknown links is always a bad idea, but a CVE for that? I dunno....

bayindirh•1h ago
Notepad was the epitome of a single, well functioning app in Windows for the last eternity of two.

Rewriting it to integrate AI and some bells and whistles recklessly and having a CVE is tragicomic if you ask me.

muvlon•1h ago
What other markdown viewers or editors support URL schemes that just execute code? And not in a browser sandbox but in the same security context notepad itself is running in.
tosti•1h ago
Clicking an unknown link shouldn't result in compromise. Fortunately, MS-Windows disallows running anything not vetted by MS unless you figure out how to bypass the "SmartScreen" filter. This filter is super annoying to many a techie or gamer, but for MS-Windows refusing to run "unknown" programs is a feature, not a bug.

So yes, MS will likely denounce this as not their problem and move on.

yrro•59m ago
This is the same company that, back in the day, warned users to not click links in Internet Explorer. A web browser.
tosti•40m ago
Funny that since the IE engine was plastered all over the place. Only 98lite could avoid it.
xxs•1h ago
clicking links should not be a security issue and yes the CVE is totally deserved: that's remote code execution.
mrweasel•49m ago
Even if you want to Notepad have clickable links, maybe not allow it to blindly allow every URL scheme known to man. It seems reasonable to limit it to do http/https and MAYBE mailto.
__bax•1h ago
Just now Notepad integrates very useful copilot assistant... What can go wrong
bstsb•1h ago
i imagine it’s probably something to do with the massive scope creep recently, especially with AI and the Markdown features - they’ve tried to fit some of WordPad’s rich text features following its removal
reddalo•1h ago
I miss when the Notepad was doing what the Notepad is supposed to do: show a text file, plain and simple.
tosti•1h ago
This was already better when the latest from MS was still called "* XP":

https://liquidninja.com/metapad/

crummy•1h ago
I used to overwrite c:\windows\notepad.exe with Metapad. At some point Windows security made this a pain though!
xnorswap•16m ago
Wow that's a hit of nostalgia, I'd completely forgotten about metapad, but I loved it back in the day.

And it's hard to believe now, but yes, support for Ctrl+S to save file was a notable feature because notepad itself didn't support that back then.

Borg3•1h ago
Haha, yeah.. Im using Notepad2 actually, because for LOOONG time, notepad.exe could not display LF files correctly... and Notepad2 has a bit more features, but still.. clean and lean.
rmunn•1h ago
"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files."

I didn't even know Notepad would render Markdown.

ddtaylor•2m ago
Torture will continue until morale improves
eviks•1h ago
What AI great job!
jfaganel99•1h ago
Notepad had one job... Seems like bringing markdown features killed it :)
netsharc•1h ago
> An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

From https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... (there are many collapsible elements on this page, and they're also just for term definitions, sigh)

What a fucking terrible page for someone unfamiliar with the site. the "Learn More" links will allow you to learn what the terms "CWE", "CVSS", "Product Status" mean, but not to learn more about this vulnerability...

Anyway, it's not related to CoPilot, but because Notepad makes links clickable now...

Fiveplus•1h ago
We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline.

For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege.

At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"

consp•1h ago
> viewing data is a fundamental failure of the principle of least privilege.

I read the cwe not cve, was wrong. It's still early in the morning...

seritools•1h ago
You are mistaken:

> The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.

mwalser•1h ago
> If I read it correctly (but could be mistaken), it runs with setuid root

I am certain you are mistaken. I couldn't find anything that hints at notepad running with elevated privileges.

dijit•57m ago
People very often run notepad as administrator (anything launched from administrative powershell instances will run like this).

In fact, if you enabled developer mode on your computer there's a registry key that gets set to run notepad as admin, it's: `runas /savecred /user:PC-NAME\Administrator “notepad %1”` in HKEY_CLASSES_ROOT-> * -> shell -> runas (new folder) -> (Default)

And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it.

Regardless, notepad is a very trusted application and is often run as Administrator. Often it's more trusted than any other utility to modify system files.

patates•51m ago
> And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it.

I think that's a notepad plus plus feature. I had it offer to reopen itself as administrator when editing system files like HOSTS.

cafebabbe•56m ago
Question is, did they even realize they added a network-aware rendering stack...
hennell•45m ago
A utility meant for viewing data? I don't think you understand what a text editor is.

I'd agree that recent features feel a bit unnecessary, but it does need to edit and write files - including system ones (going through however that is authorised). You could sandbox a lot of apps with limited impact, but it would make a text editor really useless. Least privilege principles work best when you don't need many privileges.

ntoskrnl_exe•1m ago
I’m not sure I understand what you’re trying to say. You could always edit system files with notepad, that was something that the program always excelled at thanks to its simplicity in both how it looked and behaved. And i fail to see the new features as anything but useless bloat.
AnonymousPlanet•43m ago
I'm not sure if we should use "gold standard" together with the little piece of garbage that notepad.exe was for most of its existence. It has been the bane for anyone who had to do work on locked down Windows servers and had to, e.g., edit files with modern encodings. They fixed some of it in the meantime, but the bitter taste remains.
ceving•42m ago
They should have called it Emacs. Then everybody would have known.
weinzierl•38m ago
"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text."

Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed.

I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem and we have other battles we fight.

jama211•17m ago
Fascinating reading about that bug, thanks for sharing
direwolf20•12m ago
It's not solved, we just don't have to guess the encoding any more because it's always UTF-8.
Vinnl•11m ago
https://en.wikipedia.org/wiki/Bush_hid_the_facts
g947o•5m ago
I am pretty sure there is a way to solve that entire category of bugs without introducing RCE vulnerabilities.
keepamovin•35m ago
I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile.

I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard.

It’s inspectable if you want to check the crate: https://github.com/BrowserBox/FIPSPad

mr_mitm•23m ago
Unfortunately, code execution in text editors aren't a new thing. Vim had one published in 2019: https://github.com/numirias/security/blob/master/doc/2019-06...

Another in 2004: https://www.cve.org/CVERecord?id=CVE-2002-1377

Neither vim nor Notepad are purely for displaying text though.

artemonster•20m ago
tell this to level N-1 managers that want to get promoted by the only way of "launching features"
dgxyz•1h ago
Seems whatever they do they step in shit. They should stop doing stuff.

They spent the last few years entirely compromising their products rather than improving them.

muragekibicho•36m ago
Exactly my predicament. My laptop reached EOL but I'm struggling to purchase a new one.

They're all bundled with AI features (I absolutely don't need) and never in my life will I buy a mac for coding. My current laptop is HODL'ing and idk if this enshittification will end soon.

direwolf20•9m ago
Install Linux
dgxyz•3m ago
Yeah it sucks. Got an MBP here which was my refuge from Windows. That's gone to hell too.

I am moving off onto an old desktop running Debian stable slowly as I don't really need a laptop. This also isolates me from a number of geopolitical and technology creep and lock-in related risks I have identified.

voidUpdate•1h ago
I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too
cubefox•1h ago
It needs far more features apparently. Tons more. That's why Notepad++ is popular. Which also had a severe security vulnerability recently. Which was actively exploited by some state actor like China.
leduyquang753•57m ago
That recent Notepad++ incident was a supply chain attack, not a vulnerability in the original program.
SPICLK2•54m ago
Strictly, no. But it was a vulnerability in the design of Notepad++, key elements here being the featureset that requires frequent updates and the lack of integrity checks during the upgrade process.

This has prompted me to move on from Notepad++ - it's sad, because I've used it for many years, but this is too much.

IsTom•46m ago
> in the design of Notepad++

One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.

voidUpdate•43m ago
You can if you use the windows store. It's just that you usually install things outside of that, unlike in linuxes where you generally use the package manager that can handle updates for you
SPICLK2•36m ago
I'm not sure who I trust less to handle package integrity, the 3rd party hosting provider that Notepad++ used, or Microsoft.
IsTom•29m ago
A little tongue-in-cheek, but it's also an issue with windows, that it's owned by an untrustworthy company.
RobotToaster•25m ago
Pretty sure winget does let you do that.
conductr•51m ago
The OS provided option can be bare bones, stable, secure and just utilitarian. This promotes having people choose their own tools for the features they want and not really expecting much other than reliability from the OS version. They didn’t need to mess with a good thing.

Ok, tabs, I do like the tabs.

mdavid626•59m ago
I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.
dgxyz•49m ago
Might as well just use Windows 7 if the security surface is this bad on later windows.
voidUpdate•44m ago
I have the mspaint.exe from the same version too :P. It complains about registry stuff on launch but other than that it works fine. There's no spray can in the modern paint!
jakub_g•35m ago
For those of you on macOS who still want to benefit from arguably the best drawing application ever conceived, https://jspaint.app/ is THE way. Use it all the time when editing screenshots.

Bonus point: that Windows 95 style "error" beep when pasting too large image. Always sends the shiver down the spine and confuses the coworkers around (we're an all-Mac shop).

Lex-2008•6m ago
my favorite "easter egg" hidden behind File -> Exit menu item of jspaint.app... I still remember how it blew my mind the first time I saw it!
leduyquang753•57m ago
> (though the "about notepad" dialog shows the windows 11 version for some reason??)

It's because the program just calls a Windows API to display the version dialog of Windows itself.

seritools•56m ago
you can also just uninstall the "new" notepad, at which point Windows will let you run the old one again (which is still shipped!).

By using a version that is _that_ old you do lose out on some of the actually useful updates legacy nodepad received, such as LF line ending support.

TonyTrapp•55m ago
Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.
pjmlp•33m ago
The reason being it is a plain text edit component, with a window around it, hence the limitation.
SomeUserName432•22m ago
I find notepad useful for sanitising clipboard content.

No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else.

Ala Cmd+Shift+V on Mac

xnorswap•20m ago
You can Ctrl+shift+v to paste plain text in windows.
setopt•12m ago
I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.
duskdozer•53m ago
How do you edit notes using Microsoft Copilot 365 for Notepad Copilot using that version?
IshKebab•44m ago
Support for Unix line endings at the very least.
throwaway198846•38m ago
I feel vindicated by reverting to the old windows 10 notepad.exe
kuboble•1h ago
I used notepad as my default, simple text editor for ages.

After they added copilot I finally gave up and uninstalled it and switched to a one of the minimalistic clones of the good old notepad.exe

r2vcap•56m ago
A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life.

At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

dgxyz•45m ago
Well technically Unixes like Linux are a mountain of legacy and they are fine.

Windows is just a mountain of shit.

direwolf20•10m ago
Unixes like Linux are not immune.
nananana9•2m ago
"Fine"

Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc/ when literally the only files that matter to me are in /home, which is a free-for-all?

agumonkey•23m ago
we still need a mouse icon rce until we reach peak
idoxer•53m ago
We got notepad.exe RCE before GTA 6
hdgvhicv•47m ago
So notepad now renders links, then when clicks execute the code on those links (not just loading a website in a browser for example)?
ankurdhama•6m ago
My assumption here is that if the link is web link it will open that link in web browser but Windows (and other OSes) have custom URL handlers that open whatever app is registered for that URL and that app may have issues that causes it to download and run arbitrary code.
eur0pa•41m ago
Good job!
avaer•36m ago
I'd like to point out you can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows.

This isn't an AI problem.

egorfine•35m ago
Tools are almost never the problem.

The application of tools is.

avaer•11m ago
I 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out.

There must be something much worse than slop going on to get to this point.

yellow_lead•36m ago
I'd now like to see a RCE in MS Paint or Calculator, if the exploit finder is reading this.
st_goliath•28m ago
Up next: forgotten Piet[1] autorun feature discovered in MS Paint. Customers complain after removal, insist they have existing legacy applications depending on it.

[1] https://en.wikipedia.org/wiki/Esoteric_programming_language#...

larodi•35m ago
use SublimeText, it is perhaps faster now than the stock Notepad
outime•20m ago
I can definitely vouch for this! I've been using it for many years and it's been essentially the same the whole time: fast, lean and working on all operating systems.
Krssst•13m ago
Combined with LSP I find it to be quite a good IDE too. Handles extremely large source trees quite well.
xnorswap•8m ago
As much as I used to love Sublime, the version switching caught me out which burned me a bit, even if admittedly my v2 key lasted an unreasonable time through the version 3 beta, but I don't want to risk buying a v4 key without a clear roadmap of when they might switch to version 5.
lpcvoid•21m ago
8.8 RCE CVE in notepad.exe. Well done microslop
j1000•16m ago
use linux
repelsteeltje•3m ago
I'm frankly amazed that the majority of new laptops still come with Microsoft Windows.

To be fair, over the years there have been sincere efforts to re-architect the OS with a security, privacy, reliability for peristent storage, graphics, multi-tasking, multi-user, networking etc. But those efforts never caught up with the speed at which bloat was added.

At the heart, its design still has remnants that have the naivety of a stand-alone, stateless microcomputer that boots straight off a floppy after BIOS POST.