[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7iTbfmT2I6Ip-OcKSxMNp_DzSNdm_iq_uixsP64WmXY":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"ba75c104-6a96-4ae7-bac8-0786bc3cb244","Mozilla Issues New Firefox GPG Key Following Exposure","mozilla-issues-new-firefox-gpg-key-following-exposure-9d308e","The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it. The post Mozilla Issues New Firefox GPG Key Following Exposure appeared first on SecurityWeek.","Mozilla has issued a new GPG signing subkey for Firefox and Thunderbird artifacts after its previous key was inadvertently exposed in a private GitHub repository. While the exposure posed a potential supply chain risk, Mozilla stated that an internal review found no evidence of unauthorized access. The organization has revoked the old key, issued a new one, and implemented additional protections to prevent future incidents.","Mozilla revokes Firefox GPG key after accidental GitHub repository exposure.","Mozilla announced on Monday that it has issued a new GPG signing subkey used for some Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a GitHub repository. In general, if a GPG private signing key used for software releases is exposed, an attacker who obtains it could create valid signatures on malicious files. This creates a supply chain attack risk: the attacker could distribute modified or malicious versions of the software that appear authentic. Successful exploitation would still require a way to deliver the signed files to users, for instance via a compromised mirror, an alternate download path, or social engineering. However, in Mozilla’s case, the potential impact is mitigated by several factors. The exposed GPG key was used to sign Firefox and Thunderbird artifacts such as Linux tarballs, RPM packages, and checksum files. An unencrypted copy of the key was inadvertently committed to a GitHub repository, but it was a private repository accessible only to a small group of Mozilla developers who already had access to the key via other means. “Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository,” Mozilla said.Advertisement. Scroll to continue reading. Nevertheless, the organization has decided to revoke the exposed key and issue a new one. In addition, it has added protections to prevent similar incidents in the future. Mozilla noted that most users do not need to take any action. Users who manually verify GPG signatures will have to import the new key and revocation for the old one. In addition, those who use Firefox RPM packages may need to take some steps — Mozilla has shared detailed instructions for them. It’s not surprising that Mozilla has decided not to take any chances. Given the well-documented surge in software supply chain attacks over the past year, organizations are increasingly rotating signing keys at the first sign of potential exposure. Related: Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack Related: North Korean Hackers Target Open Source Developers in Supply Chain Attacks Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Critical Flaws Discovered in Belgian eID Software Used by 2 Million PeopleCritical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise DataTruck Brake Controller’s Safety Recall Doubled as Hidden Security FixSnowflake Hacker Pleads Guilty in US CourtZero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X PostsMeta AI Hacked External Systems During Cybersecurity TestingHow a $50,000 Exploit Chain Turned Bixby Against Samsung Phones New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts Latest News OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack ConcernsStealthium Targets Security Blind Spots in AI Accelerators and Neo-CloudsCisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents BadNew Jersey, Alabama Join States Targeted in Water CyberattacksMetabase Patches Vulnerability Exploited as Zero-DayNovel Private APN Pivot Let Hackers Sabotage Second Polish Energy FacilityCISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fmozilla-issues-new-firefox-gpg-key-following-exposure\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FFirefox.jpeg","2026-08-11T06:16:01+00:00","2026-08-11T08:00:09.396601+00:00",7,[18,21,24],{"name":19,"type":20},"Mozilla","vendor",{"name":22,"type":23},"Firefox","product",{"name":25,"type":23},"Thunderbird","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":26,"icon":28,"name":29,"slug":30},null,"Supply Chain","supply-chain",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,48],{"type":46,"value":22,"context":47},"malware","Software affected by GPG key exposure",{"type":46,"value":25,"context":47}]