Mozilla Revokes GPG Signing Key After Exposure on GitHub

Theregister

Mozilla Revokes GPG Signing Key After Exposure on GitHub

First seen 11 Aug 2026, 12:08 UTC • •42.9

Article Content

1 / 7

Browse articles

ThreatCluster •August 12, 2026 at 10:54 UTC

•Mozilla revoked a GPG signing subkey after it was exposed on GitHub.
•No evidence of unauthorized access to the key was found during the investigation.
•Users who verify signatures manually must update their trust configuration.

Mozilla has revoked a GPG signing subkey used for Firefox and Thunderbird releases after an unencrypted copy was accidentally committed to a private GitHub repository. The key was used to sign Linux tarballs, RPM packages, and checksum files. Mozilla's investigation found no evidence of unauthorized access to the key while it was exposed. The affected repository was accessible only to a limited number of authorized Mozilla employees. Users who manually verify GPG signatures must import the new signing key, while most users will not need to take action. The new signing subkey expires on August 5, 2028. Mozilla has implemented additional safeguards to prevent similar incidents in the future.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 61d ago How this analysis works

Timeline

2026-08-11

GPG signing key revoked

Mozilla revoked the GPG signing subkey after it was accidentally committed to GitHub. The key was used for signing Firefox and Thunderbird releases.

2026-08-11

Investigation reveals no unauthorized access

Mozilla's review of audit logs found no evidence that the GPG key was accessed by unauthorized parties while exposed.

BleepingComputer

2026-08-11

New GPG signing key introduced

Mozilla introduced a new GPG signing subkey to replace the revoked one, which expires on August 5, 2028.

More articles in this cluster (6)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
Supply Chain Attack

Organization (1)

Mozilla

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-798 - Use of Hard-coded Credentials

Relationships

Data Breach related to Supply Chain Attack
Data Breach related to Mozilla
Data Breach related to CWE-200 - Exposure of Sensitive Information
Data Breach related to CWE-798 - Use of Hard-coded Credentials

Following this threat?

Track Mozilla in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…