GnuPG, Vim, and UnrealIRCd security notes

Several disclosures landed on oss-security covering GnuPG tooling, a Vim command-injection fix, a niche Android privilege-escalation issue, and an UnrealIRCd security release. Impact ranges from additional proof-of-concept material to low-severity or non-default configurations.

gpg.fail authors release retrospective and extra GnuPG PoC

The authors of gpg.fail published a retrospective talk with slides along with a proof-of-concept for an additional GnuPG vulnerability. The material expands on prior findings against the widely used OpenPGP implementation. Developers who rely on GnuPG for signing or encryption should review the new details for residual exposure.

Vim sign_jump Ex command injection fixed before 9.2.1090

A low-severity Ex command injection was disclosed in Vim versions earlier than 9.2.1090. The flaw arises from unescaped filenames passed to sign_jump(). Operators who process untrusted paths inside Vim should ensure they are on a patched release.

FolkPatch Android fork LPE via hardcoded SuperKey

A single report described local privilege escalation in the niche FolkPatch Android fork caused by a hardcoded default SuperKey. No follow-up discussion appeared. Users of that specific fork face an immediate credential-based elevation risk.

UnrealIRCd 6.2.7 security release and limited STARTTLS note

UnrealIRCd 6.2.7 was announced as a security release that also supplies a hot-patch for existing installations, with the affected features described as non-default. A follow-up comment downplayed the STARTTLS MITM fix, noting it applies only to non-default plaintext server-to-server links. Operators running those optional configurations should apply the update promptly.