Mozilla Revokes Firefox and Thunderbird GPG Signing Key After Accidental GitHub Exposure

Actions taken

• Revocation: Mozilla revoked the compromised key with reason code 2, which in the GPG/OpenPGP specification means "key material has been compromised" (equivalent to KEY_COMPROMISE) .

• Replacement key: A new GPG signing subkey was issued with fingerprint:

  827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3

  This subkey is valid until August 5, 2028 . The parent key fingerprint is

  14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353

  .

• Safeguards: Mozilla added internal safeguards to prevent similar accidental commits in the future .

• Impact of revocation: Because GPG revocations are permanent, files signed with the old key stop verifying once a user imports the revocation — this applies to older downloads, not just future ones .

Who needs to take action

Most users — no action required. Mozilla's official guidance states: "For most users, no action is required" . Automatic update mechanisms handle the key transition transparently.

Manual action is required for these groups:

The manual removal command (for affected distros):

Followed by

sudo dnf clean all

sudo zypper refresh

Context: broader supply chain security concerns

This incident occurred less than a week after the massive keyv npm package hijacking (ChainDrop) disclosed on August 4, 2026 . In that attack, a threat group (TeamPCP) compromised the GitHub account of the maintainer behind keyv, cacheable, and related npm packages, publishing malicious versions that deployed a self-propagating credential-stealing worm (Shai-Hulud) that spread to over 2,251 versions of 452 unique packages . The Mozilla incident highlights a different but equally urgent supply chain risk: accidental exposure of signing keys via human error in internal repositories, rather than external account compromise. Taken together, the two events underscore that software supply chain integrity faces threats from both deliberate hijacking (keyv) and inadvertent credential leaks (Mozilla) — and that both can force large-scale rotations, disrupt verification chains, and impose manual remediation on downstream users.