Abandoned CDN Domain Re-Registered; Thousands of Sites Still Reference It

Fri, 18 Sep 2026 14:58:07 +0000

Engineer — Act: This mirrors the Polyfill.io hijack pattern — any hard-coded reference to the re-registered CDN hostnames in your repos, docs, or build artifacts now loads content from an untrusted owner. Audit all codebases, IaC, and documentation for references to the named CDN hostnames and replace or remove them immediately.
SOC/IR — Plan: No confirmed malicious payload delivery is noted yet, but the new owner could begin serving malicious scripts at any time. Build a detection rule for outbound DNS/HTTP connections to the re-registered domain, and queue a proxy-log hunt back to the re-registration date of July 2025.
Leader — Plan: This is a recurring supply-chain risk class — abandoned third-party asset domains re-registered for abuse (analogous to Polyfill.io). Use this as a trigger to establish or reaffirm a policy requiring engineering teams to audit hard-coded external CDN dependencies on a regular cadence.

Dependency-Hijacking on CuraSec