The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026 [32:37]
A conference talk recounts GPG vulnerability disclosures, notes several GnuPG flaws remain unpatched, and demonstrates novel bugs live.
A researcher who disclosed multiple GnuPG vulnerabilities before 39c3 in December 2025 reports that several flaws, including one allowing spoofed PGP signatures, remain unpatched. Memory corruption in the basic PGP message parser was properly fixed, but GnuPG maintainer Werner Koch declared a widely-used feature 'harmful' instead of patching it. The talk presents additional novel GPG vulnerabilities and commentary on responsible disclosure and LLMs in security.
- Several GPG vulnerabilities disclosed before 39c3 remain unpatched, including signature spoofing
- Memory corruption in the PGP message parser was fixed
- GnuPG maintainer Werner Koch labeled the affected feature 'harmful' instead of patching it
- Talk presents new GnuPG bugs and commentary on responsible disclosure and LLMs
From the original article
2 min read at media.ccc.de
In 2025, I [the speaker] found and disclosed a bunch of vulnerabilities in GPG, the most used PGP implementation, and held a talk at 39c3 about it. Some of the bugs ended up getting fixed. This talk describes the adventure and aftermath of getting there, shows some novel ones, and talks about the state of security in 2026.
By media.ccc.de via dzwdz · media.ccc.de
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.