Wire · technology
Mozilla Rotates Firefox and Thunderbird GPG Key After Private GitHub Exposure
◆ Sectors
◆ Source
◆ Verified
Fusion42 · 12 August 2026 · Fusion42 review
Mozilla rotated the GPG signing subkey for Firefox and Thunderbird release files after an unencrypted copy was accidentally committed to a private GitHub repository, with no evidence of unauthorized access. Linux users on certain RPM-based distributions need to update their local signing keys to ensure smooth package updates.
This Wire brief sits within Fusion42's coverage of Enterprise Software, and 2 sources have reported it between 11 Aug 2026 and 12 Aug 2026.
◆ ◆ The Wire takeaway
Manual verification of Firefox and Thunderbird packages now requires updating signing keys on specific Linux distributions. If you maintain or verify Linux RPM packages, update your key or risk update failures.
◆ Coverage
2 sources · first reported 11 Aug 2026 · latest 12 Aug 2026
◆ Related on Wire
◆ Topics