From the outside, Obsidian Entertainment seemed to have a great 2025, shipping no less than three games: Avowed, The Outer Worlds 2, and Grounded 2 in early access. But as sales of the first two apparently underwhelmed parent company Microsoft, the studio's boss thinks going so hard over such a short stretch of time wasn't the best decision.

Feargus Urquhart, CEO and co-founder of Obsidian, reflects on the year that was for Bloomberg. "They're not disasters. I'm not going to say this was a kick in the teeth," he states, referring to The Outer Worlds 2 and Avowed. "It was more like: 'That sucks. What are we learning?'"

Indeed, Grounded 2 provided a sharp contrast, immediately trouncing the predecessor's records on Steam and attracting three million players in its first two weeks. Those numbers compelled Obsidian to "think a lot about how much we put into the games, how much we spend on them, how long they take."

Being in development for six years each, fantasy adventure Avowed and spacefaring sci-fi jaunt The Outer Worlds 2 absorbed a lot of resources and attention, and Urquhart now wants to shave the time per game down to between three and four years. By the same token, he'd like to have a more spread out the company's output moving forward, conceding the strategy wasn't ideal.

"Spacing those releases helps the company manage its resources and not burn everybody out," Sawyer adds. "It's not good to release three games in the same year. It's the result of things going wrong."

Despite Avowed and The Outer Worlds 2 being on opposing sides in terms of backdrop and aesthetic, there's a sense that the devs were competing with themselves, putting both out in the space of a year. That's before factoring in all the other games they're up against, including Clair Obscur: Expedition 33, Borderlands 4, and Final Fantasy Tactics - The Ivalice Chronicles.

The RPG market doesn't offer a lot of space right now, and these are projects that deserve proper time for you to soak into their narratives. Obsidian seems to be learning the right lessons from this situation, and with any luck, these games will find their audiences in due time.

After deciding not to charge $80 for The Outer Worlds 2, Xbox head says Microsoft will keep listening to fan feedback but has to run a "healthy business"

Popular open source text editor Notepad++ experienced a significant security breach last year, and now its developer has given an update regarding the attack.

It's believed that, between June and November 10/December 2, 2025 (independent security experts and its hosting provider disagree on the exact timings), a shared hosting server was compromised, allowing attackers to redirect Notepad++ update traffic to malicious servers.

"According to the analysis provided by security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org." says a statement on the now-secure website.

"The exact technical mechanism remains under investigation, though the compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself."

The update goes on to say that "Multiple independent security researchers have assessed that the threat actor is likely a Chinese state-sponsored group, which would explain the highly selective targeting observed during the campaign."

According to cybersecurity firm Rapid7, the attack can be contributed to Chinese APT group Lotus Blossom, a threat actor that has been known to perform "targeted espionage campaigns" primarily impacting organisations across Southeast Asia and Central America. The custom backdoor used in the attack has since been dubbed "Chrysalis", and explaining its methodology is where I start to get lost, so I'll quote directly from the Rapid7 report instead:

"Its wide array of capabilities indicates it is a sophisticated and permanent tool, not a simple throwaway utility. It uses legitimate binaries to sideload a crafted DLL with a generic name, which makes simple filename-based detection unreliable.

"It relies on custom API hashing in both the loader and the main module, each with its own resolution logic. This is paired with layered obfuscation and a fairly structured approach to C2 communication."

Of course, of course. However, Rapid7's main concern appears to be what Chrysalis, and other tools and methods used in the attack, says about Lotus Blossom's newfound capabilities:

"While the group continues to rely on proven techniques like DLL sideloading and service persistence, their multi-layered shellcode loader and integration of undocumented system calls (NtQuerySystemInformation) mark a clear shift toward more resilient and stealth tradecraft," says the firm.

"This demonstrates that Lotus Blossom is actively updating their playbook to stay ahead of modern detection."

Gulp. So, while the Notepad++ developer has since switched to a different hosting provider (with what are described as "significantly stronger security practices"), it seems that Lotus Blossom is gaining strength—and some hosting providers are falling victim to its modern methods. Sleep tight, website.