Mozilla updates GPG signing key for Firefox releases after exposure
Source Bleeping Computer
Description
Mozilla updated the GPG signing subkey used for Firefox and Thunderbird releases after the previous key was accidentally exposed in a private GitHub repository. The exposure risk is considered low because access to the repository was limited to a small group within Mozilla who already had authorized access to the key. Mozilla found no evidence of unauthorized access to the exposed key. The old key was revoked, and users who manually verify GPG signatures need to import the new key and revocation. Linux users installing Firefox via RPM packages may need to manually update their systems to continue receiving updates. Thunderbird users are not affected by RPM-specific actions. The new signing subkey expires in August 2028.