Mozilla Rotates Firefox and Thunderbird GPG Signing Key After Private GitHub Exposure

Gbhackers •Divya • August 11, 2026

Mozilla has rotated a GPG signing subkey used to authenticate release artifacts for Firefox and Thunderbird after an unencrypted copy of the subkey was unintentionally committed to a private GitHub repository. The affected signing infrastructure includes selected release files, such as Linux tarballs, RPM packages, and checksum files. Mozilla’s investigation into available audit logs […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mozilla Revokes GPG Signing Key After Exposure on GitHub Mozilla has revoked a GPG signing subkey used for Firefox and Thunderbird releases after an unencrypted copy was accidentally committed to a private GitHub repository. The key was used to sign Linux tarballs, RPM packages, and checksum files. Mozilla's investigation found no evidence of unauthorized access to the key while it was exposed. The affected repository was accessible only to a limited number of authorized Mozilla employees. Users who manually verify GPG signatures must import the new signing key, while most users will not need to take action. The new signing subkey expires on August 5, 2028. Mozilla has implemented additional safeguards to prevent similar incidents in the future. 5 sources 43

Extracted Entities

Companies (1)

Mozilla