Mozilla rotates Firefox/Thunderbird GPG signing key after GitHub leak

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Plan: If your pipelines or package managers verify Firefox or Thunderbird downloads against Mozilla’s GPG key, update your keyring to the new signing key; automated verification scripts referencing the old key will fail or trust a compromised key.
SOC/IR — Learn: No exploitation signals or IOCs reported; the key rotation is a supply chain hygiene incident worth understanding for context on how signing-key exposure can create a window of trust ambiguity before rotation.
Leader — Learn: Mozilla acted quickly to rotate after accidental exposure with no confirmed misuse — a useful case study in supply chain key incident response, but no vendor attestation or internal exposure assessment is warranted at this time.

Mozilla on CuraSec