MICROSOFT'S NOTEPAD GOT PWNED (THEY ADDED AI TO IT, SO...)

Summary from the TLDR InfoSec newsletter

CVE-2026-20841 (CVSS 8.8) is a command injection flaw in Microsoft's updated Notepad (versions 11.0.0 to 11.2509). The vulnerability arises because the Markdown handler does not validate link content before execution, allowing attackers to execute remote code when users open a malicious .md file and click an embedded link. Public proof-of-concept exploits exist, and the vulnerability is actively being exploited, granting attackers full permission to execute code. Microsoft addressed this issue in Notepad build 11.2510+ on February 10. Users are advised to disable Markdown and link previews when unnecessary.