Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has revoked and replaced a GPG signing key after an unencrypted copy of the secret key was accidentally uploaded to a private GitHub repository. The key had been used to sign Linux archives, RPM packages, and associated checksum files for Firefox and Thunderbird.
The incident created a theoretical risk that an attacker could have used the key to sign malicious installers and present them as official releases. However, Mozilla assessed the supply-chain risk as low because the repository was accessible only to a limited group of internal employees who already possessed legitimate access to the key.
Audit log reviews showed no indications that the key had been accessed or misused by unauthorized parties. As a result, the company revoked the old key and issued a replacement that will remain valid until 5 August 2028.
Most end users do not need to take any action. Individuals who manually verify GPG signatures on downloaded files must import the new public key and the revocation certificate for the previous key.
Users installing Firefox from RPM packages on Linux distributions may face additional steps. Depending on the distribution, they will need to update the signing key manually; otherwise, newer browser versions may fail to install. Mozilla has published specific instructions for Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE.
Thunderbird users are not affected by the RPM-related instructions because the mail client does not provide official RPM packages. Updated public key material and revocation information are available in the current KEY files for Firefox Nightly and on the keys.openpgp.org server.
Mozilla stated it will implement additional safeguards to prevent secret keys from being committed to repositories in the future.
Related articles
redb 3.7.2 Released with Custom gRPC Protocol, Dependency Vulnerability Fixes and .NET 10 Migration
The redb ecosystem released versions 3.7.0, 3.7.1 and 3.7.2 in quick succession after 3.7.0 was withdrawn due to high-severity vulnerabilities in its .NET 9 build artifacts. NuGet audit detected issues only on full rebuilds, leading to updates for SSH.NET, Microsoft.Data.Sqlite, System.Security.Cryptography.Xml and Microsoft.Bcl.Memory across redb.Route, redb.Core, redb.Export and redb.Identity. The release introduces a native GrpcWire implementation that registers individual gRPC methods as routes on a shared Kestrel host, supports bidirectional streaming, real gRPC status codes and mTLS with pinned client certificates. redb.Route also gained a dedicated SOAP connector, Control Bus messaging for route lifecycle management and a corrected Claim Check pattern. File transports received critical fixes that prevent silent data loss when readLock and idempotency options are combined. All libraries now target net8.0;net9.0;net10.0 while host applications require .NET 10, aligning with Microsoft’s shortened support timeline for .NET 8 and 9.
Poisoned Rust Crates Execute Malware at Build Time: 245 Million Downloads Hit in Supply-Chain Attack
Three widely used Rust crates on crates.io were poisoned on August 20 with malicious versions that execute automatically during cargo build. The attack leveraged a typosquatted proc-macro1 dependency containing a build script that downloads payloads and establishes persistence. arrayref alone has accumulated 245 million downloads and is pulled automatically through caret ranges in many dependency trees. Attack infrastructure overlaps with prior campaigns attributed to Sapphire Sleet and MIDNIGHT NEPTUNE. Rust security teams yanked the malicious releases within 86-107 minutes, but the incident highlights missing publish-age controls and weak maintainer-account protections in the Cargo ecosystem.
PyPI Explores Prefix Reservation for Organizations Under PEP 752 to Prevent Name Squatting
PEP 752 proposes reserving package name prefixes for organizations on PyPI, allowing control over entire families of related package names rather than individual entries. The change addresses dependency confusion and name squatting risks where attackers register packages with familiar prefixes like google-cloud- or opentelemetry- to exploit user trust. Analysis of over 800,000 PyPI projects by CodeScoring shows that prefixes are rarely controlled by a single owner, with ecosystems like aws- managed by hundreds of accounts. The proposal introduces implicit namespaces and new metadata for clients and proxies while preserving the flat namespace model familiar to Python developers. PEP 755 will define the governance process for granting prefix rights, limiting applications to organizations and requiring clear justification. Existing packages receive backward compatibility exceptions, and the mechanism does not transfer across repositories.
Suspicious Certificate Issuer Detected in MAX Messenger Windows Update Package
A detailed observation from a security researcher highlights an unexpected change in the code signing certificate for the MAX messenger desktop client on Windows. The August update package was signed by an individual named Konstantin Syomochkin instead of the usual Communication Platform LLC. This discrepancy raised concerns about potential supply chain interference linked to recent EU sanctions against the developer. The certificate was issued shortly after sanctions and belongs to a person based in Astana, Kazakhstan, with limited public ties to the VK team. Official MSI installers downloaded directly from the MAX website remain signed by the company, while the client-triggered update differs in both version and signer. The researcher recommends that VK verify the download chain through Mail.ru trackers to rule out tampering. Installation of the update was declined pending further clarification.