Loading story…
German authorities published advisories for multiple vulnerabilities affecting GnuPG and Gpg4win, indicating that both the core encryption toolset and its Windows distribution are impacted. One advisory covers GnuPG specifically, while a later notice expands the scope to include Gpg4win, signaling broader exposure for organizations that rely on these tools for email encryption, signing, and key management.
The disclosures highlight potential risk to environments using OpenPGP-based workflows on both standalone GnuPG deployments and Windows endpoints running Gpg4win. Organizations using these products should review the vendor and national CERT advisories, identify affected versions, and prioritize available updates or mitigations to reduce the risk of compromise involving cryptographic operations and trusted communications.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT issued Advisory 2026-0229 covering multiple vulnerabilities affecting GnuPG and Gpg4win. This represents a later disclosure expanding or separately documenting security issues involving both products.
dCERT issued Advisory 2025-2723 covering multiple vulnerabilities in GnuPG. The advisory indicates public disclosure of a set of security issues affecting GnuPG.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities published advisories for **multiple vulnerabilities** affecting **Foxit PDF Reader** and **Foxit PDF Editor**, indicating ongoing security issues across the vendor's desktop PDF products. The notices identify separate advisory entries, `2026-0914` and `2026-1256`, covering flaws in both **Reader** and **Editor** and signaling that organizations using Foxit software should review the affected versions and available vendor guidance. The repeated disclosures suggest a broader patch-management concern for enterprises that rely on Foxit for document handling, particularly because PDF applications are common targets for malicious document-based exploitation. Security teams should prioritize validating installed Foxit versions, applying relevant updates, and monitoring for suspicious PDF-related activity on endpoints where Foxit Reader or Editor is deployed.
Jun 29, 2026
Microsoft disclosed and patched two **remote code execution** vulnerabilities in the Windows **Pragmatic General Multicast (PGM)** component, tracked as `CVE-2023-28250` and `CVE-2023-36397`. Both issues were published through Microsoft's Security Update Guide and affect the Windows networking feature used for reliable multicast message delivery. The advisories indicate that successful exploitation could allow code execution through the vulnerable PGM service, making exposed Windows systems a priority for patching. Organizations using Windows hosts with the PGM feature enabled should verify that security updates covering both CVEs have been applied and review asset exposure tied to the affected multicast service.
Jul 12, 2026
German government advisories warned of security flaws in two widely used image-processing applications, with **GIMP** affected by a vulnerability that could allow **code execution** and **ImageMagick** affected by a separate flaw that could enable an **unspecified attack**. The notices identify both products as requiring security review because they are commonly used to open, convert, and manipulate untrusted image files in desktop and server-side workflows. The GIMP issue presents the more severe risk because successful exploitation could let an attacker run code on a target system, while the ImageMagick issue may expose systems that rely on automated image handling to further compromise depending on deployment context. Organizations using either tool in user workstations, content pipelines, or backend processing environments should verify affected versions, apply vendor fixes or distribution updates, and restrict processing of untrusted files until remediation is complete.
Jun 29, 2026