Chinese state-sponsored group Lotus Blossom hijacked Notepad++'s update mechanism for six months. Also: Conduent ransomware breach hits 25M+ Americans, critical n8n sandbox escape enables RCE, and a Microsoft Office zero-day is under active exploitation with a CISA KEV deadline of February 16.