Mozilla Updates GPG Signing Key After Accidental Exposure, Low Risk of Malicious Activity
A recent security incident has prompted Mozilla to update the GPG signing key used for Firefox and Thunderbird releases. The company had inadvertently exposed an unencrypted copy of the previous subkey on a private GitHub repository, sparking concerns about potential supply chain attacks. However, according to Mozilla’s assessment, the risk of malicious activity is low due to limited access to the repository.
The incident occurred when an unauthorized individual gained temporary access to the GitHub repository, where they discovered an unsecured version of the GPG signing subkey. While Mozilla has yet to find any evidence that the key was accessed by unauthorized parties during its exposure, the company took swift action to mitigate potential risks. To address the issue, Mozilla revoked the old GPG key and introduced a new one, which will be used for Linux tarballs, RPM packages, and checksum files.
The update primarily affects users who manually verify GPG signatures or install Firefox using RPM packages on their systems. Those who rely on automatic updates will not need to take any action. However, users who do require manual verification must import the new signing key and revocation for the old key. Mozilla has provided detailed instructions for updating Linux systems running Fedora 43 and later, as well as RHEL/Rocky/Almalinux and openSUSE/SUSE-based distributions.
Thunderbird users are not affected by this update since they do not rely on official RPM packages. The new signing subkey will remain valid until August 5, 2028, and the public key is available through the latest Firefox Nightly KEY files and keys.openpgp.org.
The incident highlights the importance of secure practices in software development and distribution. While Mozilla’s swift response to the situation minimized potential risks, it also underscores the need for developers to prioritize security measures and maintain robust access controls to prevent similar incidents from occurring in the future. To ensure your own systems remain secure, consider implementing regular audits and penetration testing to identify vulnerabilities before attackers do.
As a general best practice, users should be cautious when installing software updates or verifying GPG signatures, especially if they have manually configured their systems for signature verification. Regularly review and update your system configurations to stay protected against potential security threats.
Source: Bleeping Computer — 2026-08-11