Mozilla Swaps Out Firefox and Thunderbird Signing Key After It Leaked on GitHub
Mozilla has confirmed that the cryptographic key it uses to sign Firefox and Thunderbird release packages was inadvertently posted on GitHub, forcing the organization to generate and roll out a replacement. GPG signatures let users and package managers confirm that a downloaded build genuinely came from Mozilla and hasn't been tampered with in transit, so any leak of the private key undermines that trust chain until it's revoked.
Mozilla says it has already switched over to the new key and revoked the exposed one, meaning future releases will be signed with the updated credentials. The company hasn't indicated that any malicious use of the leaked key occurred, but as a precaution it's asking downstream packagers, Linux distribution maintainers, and anyone else who verifies Firefox or Thunderbird builds to update their trusted keyrings accordingly.
Exposures like this are usually the result of a signing key or its passphrase ending up in a public repository, config file, or CI/CD log by mistake rather than a targeted breach. Mozilla hasn't detailed exactly how the key ended up on GitHub, only that it was found and addressed quickly.