Researchers warn about critical flaws in PGP and S/MIME that can reveal the plaintext of encrypted emails, recommend uninstalling those tools from email clients
The flaws, can expose e-mails sent in the past and “pose an immediate threat.” — The Internet's two most widely used methods …
Context & Ripple Effects
The advisory lands on an email-encryption stack already under strain. A month later, researchers detailed SigSpoof, a signature-spoofing flaw in PGP that had existed since 1998, and by mid-2019 unknown attackers were spamming OpenPGP certificates to break a core component whose weakness had been known for a decade.
The recommendation to uninstall rather than patch is the striking part: it treats the integration layer between encryption libraries and mail clients as unfixable for now, echoing how the same research community later found fundamental cryptography flaws in MEGA's end-to-end scheme and widespread SSH key exposure.
First-order effects
- Users of PGP and S/MIME plugins in their email clients face an immediate choice between disabling encryption and risking decryption of messages sent years earlier, since the flaws expose past ciphertext, not just future mail.
Second-order effects
- Email client vendors and PGP/S/MIME maintainers are pushed into emergency patches and compatibility changes, while organizations that relied on these tools for compliance-grade confidentiality must find interim channels for sensitive correspondence.
Third-order effects
- If the pattern holds — implementation flaws surfacing in systems trusted for decades, from PGP signatures to SSH keys — confidential email drifts away from open client-side plugin encryption toward integrated, vendor-controlled secure messaging.
The trend: Decades-old open email-encryption standards are losing user trust as researchers repeatedly show that their client integrations, not just their math, fail under attack.