Security and cryptography digest for 2026-09-27

Security and cryptography discussions on 2026-09-27 centered on a claimed attack against Classic McEliece, maintainer replies to gpg.fail findings, and a privilege-escalation report in libextractor. The exchanges focused on cost models, historical bugs, and intended use of libraries in privileged contexts.

Claimed quasipolynomial attack on Classic McEliece

The pqc-forum examined a claimed quasipolynomial attack on Classic McEliece parameters. Bernstein and other participants debated attack cost models and the resulting impact on those parameters. The analysis matters to anyone tracking the security margin of code-based post-quantum schemes.

GnuPG maintainers reply to gpg.fail retrospective

GnuPG maintainers responded on oss-security to a retrospective published by the gpg.fail authors. The thread addressed claimed remote code execution, a printf bug, and broader PGP format problems. Developers who depend on GnuPG have a direct interest in how these issues are characterized and resolved.

Privilege escalation CVE in GNU libextractor

A CVE was reported for GNU libextractor versions before 1.16, in which getenv handling of LIBEXTRACTOR_PREFIX can enable setuid privilege escalation. A responder questioned whether the library was ever intended for privileged use. Systems that invoke libextractor from elevated contexts should assess exposure.