GKRootWire
AI xAI Publishes Details on Its Grok Web CrawlerAI Why 'Human-in-the-Loop' Might Have It BackwardsDev Tools Modular Ships Mojo 1.0, Marking the Language's Production DebutAI OpenAI's Head of Ethics Exits Less Than a Year Into the JobAI Researchers Show How to Extract Hidden Reasoning from Proprietary LLM APIsAI Nvidia Debuts Nemotron 3.5 Lightning and NeMo Switchyard for Local AI WorkflowsAI xAI Publishes Details on Its Grok Web CrawlerAI Why 'Human-in-the-Loop' Might Have It BackwardsDev Tools Modular Ships Mojo 1.0, Marking the Language's Production DebutAI OpenAI's Head of Ethics Exits Less Than a Year Into the JobAI Researchers Show How to Extract Hidden Reasoning from Proprietary LLM APIsAI Nvidia Debuts Nemotron 3.5 Lightning and NeMo Switchyard for Local AI Workflows
Security

Mozilla Swaps Out Firefox and Thunderbird Signing Key After It Leaked on GitHub

A GPG key used to verify the authenticity of Firefox and Thunderbird releases was accidentally exposed, prompting Mozilla to retire it and issue a new one.

D
By David, AI Engineer · Aug 12, 2026

Mozilla has confirmed that the cryptographic key it uses to sign Firefox and Thunderbird release packages was inadvertently posted on GitHub, forcing the organization to generate and roll out a replacement. GPG signatures let users and package managers confirm that a downloaded build genuinely came from Mozilla and hasn't been tampered with in transit, so any leak of the private key undermines that trust chain until it's revoked.

Mozilla says it has already switched over to the new key and revoked the exposed one, meaning future releases will be signed with the updated credentials. The company hasn't indicated that any malicious use of the leaked key occurred, but as a precaution it's asking downstream packagers, Linux distribution maintainers, and anyone else who verifies Firefox or Thunderbird builds to update their trusted keyrings accordingly.

Exposures like this are usually the result of a signing key or its passphrase ending up in a public repository, config file, or CI/CD log by mistake rather than a targeted breach. Mozilla hasn't detailed exactly how the key ended up on GitHub, only that it was found and addressed quickly.

Why it matters: Signing keys are a foundational piece of software supply-chain security — if an attacker had gotten hold of the private key before revocation, they could theoretically have signed malicious builds that looked legitimate. Anyone who automates verification of Firefox or Thunderbird downloads, especially Linux distro maintainers and enterprise deployment tools, should update their trusted key list now rather than assume the old one still works.

Sources: BleepingComputer

Related articles

Discover more