Affected Systems

Thousands of websites, code repositories, and documentation pages with hard-coded references to an expired CDN domain, re-registered in July 2025. The new owner controls wildcard DNS for the entire domain and all traffic to hostnames beneath it. No specific vendor or product; affects any organization with legacy third-party script references to the abandoned CDN.

Exploitation Status

Active exploitation confirmed. The re-registered domain is currently serving ad-heavy content and the new owner has full control over what code is delivered to all dependent sites. Similar pattern previously observed with polyfill.io in June 2024, which served conditional redirects to 110,000+ sites after ownership change.

Business Impact

Third-party scripts execute with full first-party privileges in the browser: can read DOM, intercept form input (including credentials and payment data), access cookies and local storage, and exfiltrate data. Static analysis and server-side scanning cannot detect this risk because malicious code is fetched live by the visitor's browser and can vary by geography, user agent, or time. Organizations have no visibility into what code actually executes on their pages without client-side monitoring. For PCI DSS v4.0.1 compliance, requirements 6.4.3 and 11.6.1 mandate script inventory, integrity assurance, and unauthorized modification detection on payment pages as of March 31, 2025.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all third-party script references across web properties, code repositories, and documentation for references to the abandoned CDN domain and other legacy or expired CDN hostnames.
  • Deploy Content-Security-Policy-Report-Only header to gather real-time data on all scripts executing in user browsers without breaking functionality; review reports for unauthorized or unexpected domains.
  • Implement Subresource Integrity (SRI) hashes for all third-party scripts to ensure code integrity and prevent silent modification by external parties.
  • Establish a written inventory of all authorized scripts on payment and sensitive pages with business justification, as required by PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1.
  • Monitor CSP violation reports continuously for new or changed third-party domains; investigate and approve or block changes as part of change management process.