From: "GOG.COM" <newsletter@email3.gog.com>
Subject: [ ACTION NEEDED ] Update your GOG GALAXY for a host of improvements!
We noticed you're using an outdated version of the GOG GALAXY client.
You can easily fix that with just a few clicks and start experiencing a host of improvements we've introduced.

I'm not using the Galaxy Client at all.

Have you EVER used it?

Got the same email, but haven't experienced any bugs or errors with the version I have. Rather seen people reporting issues with newer versions here on the forums.

Probable phishing.

How I loathe these aggavatingly exaggregated and alarming headlines / subjects that have become the de facto standard these days. There's absolutely NOTHING that would even suggest, even less need action, especially since Galaxy is completely optional to begin with. Whoever let these attention-whores write for GOG accelerated its downward spiral, if only by alienating me. -.-

"Acton needed" and "easily fix that with just a few clicks" almost guarantees there's a lot of strings attached, so I'll most likely do the opposite (not restricted to GOG).

Now, it there was an API change that would somehow break older versions of Galaxy, then this alarmingness might be justified, but there seems to be no mention of it. Likewise, if there were important security fixes, but they didn't mention any, either. If so, that means there was a data breach within GOG... could the affected people please post the link from within the mail, if they have opened the message (if not, then leave it and possibly delete it), and the purpoted sender address (thunderbird has that as the last entry in the hover-tooltip (finally!); some scammers put a fake sender mail before the true one, so the "<newsletter@email3.gog.com>" might be fake unless it's the only one in the sender line).

Yep. That's Phishing. The attention demanding 'Action Needed' is a red flag.

even though the server appears to legit (newletter@email3.gog.com) I suspect server spoofing is in effect as well, so just delete the email. they are good phishers then since they are spoofing the official newsletter server, but spoofing isnt THAT hard to do.

I didn't receive the email, so I agree with Lord_Kane that it's very likely spoofing.

I also got this email and it's suspicious as all fuck. Even if it's legit, the wording and subject set off all my scam alarms. I did not sign up for emails like this and barely ever use Galaxy anyway. This is really weird.

Didn't get such an email i think but i do use galaxy.

Wouldn't it have been simpler to format it as "Security Bulletin: CVE discovered in Galaxy, please update to [versionNo]?"

Then use the body of the email to dryly explain the issue and why upgrading is something cool kids do?

I don't use Galaxy, but I do use Heroic Games Launcher and I still got that email. Since Heroic uses the Galaxy API and builds, I guess it might appear as though I am using Galaxy.

Does anyone know what the update fixes?

It's simply marketing rhetoric to encourage users to download/update Galaxy. I don't know exactly what the latest changes are, but what it 'fixes' depends which version of Galaxy you are going from and to. For you, it will just cause more problems than it solves.

Anytime an email says [ACTION NEEDED] with all capital letters, it's a big red flag for me. I instantly ignored it but apparently it is, in fact, a legit email from Gog just telling us to update Galaxy.