Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
Summary: Mozilla revoked the OpenPGP subkey used to sign Firefox and Thunderbird Linux downloads after an unencrypted copy was committed by mistake to one of its own private code repositories. The revocation certificate carries reason code 2, "key material has been compromised," generated August 6, 2026 at 11:14 UTC, and the replacement subkey published Monday has fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, valid until August 5, 2028.
Bottom line: Mozilla says audit records show no unauthorized access, yet it still chose reason code 2 over a routine rotation - and that code makes every signature the old subkey ever produced stop verifying, including older downloads. The swap also came about seven months before the revoked subkey's March 2027 expiry, which tells you how the organization treats a key it can no longer fully account for.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026