Mozilla has rotated the GPG private key it uses to sign every Firefox and Thunderbird download after someone accidentally committed the key to a private GitHub repository. The organization revoked the old key on August 6, 2026 with reason code 2 — “key material has been compromised” — and published a new signing key the same day, valid until August 5, 2028.
The good news: Mozilla says there is no evidence that anyone outside the company accessed the key while it sat in the repository. Access was restricted to a small internal group, all of whom already had legitimate access to the key through other channels. The repository was private. Still, Mozilla decided to rotate the key out of an abundance of caution, seven months earlier than its scheduled March 2027 expiry date. The new key fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3. The timing is notable: the incident comes just one week after attackers hijacked the GitHub account behind the popular keyv and cacheable npm packages and used it to publish a worm designed to steal credentials and private keys from developer machines.
How to check if you’re affected
Affected products are limited to Firefox and Thunderbird installations on Linux systems that use RPM-based packaging (Fedora, RHEL, openSUSE, and similar). If you install Firefox through your distribution’s standard package manager (APT on Debian/Ubuntu, or the Snap store), or you use the regular Windows or macOS installer, you do not need to take any action.
If you use RPM packages from Mozilla’s repository, you may see failed updates. The fix is to remove the old key and import the new one:
sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
sudo dnf clean all
On openSUSE, use the same two rpm commands, then run zypper refresh. On some distributions, dnf will handle the key swap automatically when you next run an update, prompting you to confirm the new fingerprint.
If you verify Firefox download signatures manually, you also need to import the new public key and the revocation certificate for the old one from Mozilla’s signing repository.