The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026

说明与用途

2025年，研究人员发现了多个GnuPG漏洞，部分已修复但仍有未修复。39c3演讲展示了签名伪造和内存损坏，并讨论了负责任披露和AI在安全中的作用。

问题

Vulnerabilities in GnuPG (GPG) were discovered but many remained unpatched, exposing users to spoofed signatures and memory corruption.

结果

The talk highlighted persistent security issues in GnuPG, underscored the need for better responsible disclosure, and showcased the state of the codebase.

工作流

• Discovered initial vulnerability in GPG
• Identified additional independent bugs over months
• Disclosed vulnerabilities weeks before 39c3
• Presented findings at 39c3
• Demonstrated unpatched flaws live
• Discussed responsible disclosure practices and AI impact

证据

Some of the bugs ended up getting fixed.

来源

One of the first vulnerabilities I found remains unpatched to this day.

来源