Mozilla has replaced the GPG signing key used for Firefox and Thunderbird releases following an accidental exposure on GitHub. The security update ensures the integrity of future software releases.
The exposed key, which authenticates Firefox and Thunderbird binaries, was discovered on a public GitHub repository. Mozilla acted quickly to rotate the compromised credential and implement a new signing key for all upcoming releases.
GPG keys serve as digital signatures verifying that software downloads haven't been tampered with. An exposed key could theoretically allow attackers to distribute malicious versions of Firefox or Thunderbird while passing signature verification checks.
Mozilla did not report any evidence that the key was exploited before discovery. Users running current versions of Firefox and Thunderbird remain unaffected, as the existing signatures remain valid. However, the organization recommends users verify future releases use the updated key for maximum security assurance.
This incident highlights the importance of secure credential management even for organizations with strong security practices. Mozilla's rapid response demonstrates standard protocol for addressing compromised cryptographic material.
Security group Nightmare Eclipse has disclosed a zero-day vulnerability in Microsoft Defender named 'ShieldBreak' that grants SYSTEM-level privileges. The exploit emerged after Microsoft's August 2026 Patch Tuesday updates.
Wesco, a global supply chain and distribution company, acknowledged a cybersecurity incident following claims by ExfilSquad that it stole company data. The investigation is ongoing.
Signal has rolled out Automatic Key Verification, a new security feature designed to prevent man-in-the-middle attacks on encrypted messages. The feature strengthens Signal's existing encryption protections.
Hackers compromised a heat-and-power facility in Poland that serves approximately 50,000 residents by exploiting a private APN connection to access its operational technology network.