Mozilla updates GPG signing key for Firefox releases after exposure

Mozilla announced it updated the GPG signing key for Firefox and Thunderbird releases after the key was accidentally exposed on GitHub. The exposure could have allowed attackers to sign malicious releases. Users are advised to verify signatures with the new key. Mozilla has not reported any active exploitation of the exposed key. The incident highlights risks of credential exposure in open-source development workflows.