[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feUqUt1KKKWZ0dgx2EbW6TPePbT9EG-TnFsrywrYURTk":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"aec36c0c-e3b4-4400-81b4-b38a2f931ea7","An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.","an-abandoned-cdn-domain-was-re-registered-thousands-of-sites-still-call-it-851352","In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it. The new owner holds","A previously abandoned CDN domain was re-registered, and thousands of websites, code repositories, and documentation pages still reference it. The new owner now controls any hostname under this domain, potentially injecting malicious code into these sites without their owners' knowledge. This highlights a significant supply chain risk where third-party scripts, fetched by the browser, can be compromised long after initial deployment, bypassing traditional server-side security scanning.","Re-registered CDN domain exposes thousands of sites to potential malicious code injection.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fan-abandoned-cdn-domain-was-re.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh4A312zOZ7ftKXmWapCccs7ZW6g3d61vCPFzToGj6Y9nRb2cXUHcQ9__5Taotig6y1W_tljoo5ih74cJCTxZzfz5Ii0MMoLcBuUZS6fQCgn_L4zmq92Zamf2FJM-oT3ptyyzPM-2c1oyZSZSn3eYiUp0QidqC2N2tYT9GFrqAYitjrco1cmrDJRCm6HEk\u002Fs1600\u002Freport-uri.jpg","2026-09-18T11:01:16+00:00","2026-09-18T14:00:20.835632+00:00",8,[17,20,22,24],{"name":18,"type":19},"Content Delivery Network (CDN)","technology",{"name":21,"type":19},"JavaScript",{"name":23,"type":19},"Content Security Policy (CSP)",{"name":25,"type":26},"ClickFix","campaign","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"domain","polyfill.io","Example of a third-party JavaScript shim that changed ownership and served conditional redirects.",[],{"controls":52,"vendors":134},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":44,"name":83,"problem":84,"products":85},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":111,"name":112,"problem":113,"products":114},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[115,121,129],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":148},"abandoned-cdn-domain-hijacked-threatening-thousands-of-websites","Abandoned CDN Domain Hijacked, Threatening Thousands of Websites","The root cause of this incident is a failure in third-party dependency lifecycle management — the abandoned CDN domain was never removed from dependent codebases when it was decommissioned, leaving a persistent and unmonitored attack surface. When the domain was re-registered by a new owner, they instantly inherited control over any script or resource still being fetched by thousands of websites, effectively turning a forgotten reference into a ready-made supply chain attack vector. This matters because browser-side script injection can bypass all server-side security controls, enabling attackers to steal credentials, exfiltrate data, or deliver malware directly to end users at scale. The incident underscores how technical debt in the form of stale external dependencies can silently accumulate into critical vulnerabilities long after the original integration.",[140,141,142,143,144,145,146,147],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-3: Personnel activity is monitored","NIST SP 800-53 SA-12: Supply Chain Protection","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (third-party risk)","W3C Subresource Integrity (SRI) Specification",{}]