Abandoned CDN Domain Re-Registration Leaves Thousands of Sites Exposed to Live Script Substitution
An expired CDN domain now under new control continues to receive live traffic from thousands of sites that never removed the references. Conventional server-side scanning misses the risk because the malicious payload arrives only at the browser. CSP reporting provides the only reliable detection channel for these post-deployment supply-chain substitutions.
The re-registered domain retains active callers because the original CDN wind-down left no revocation mechanism or deprecation notices. Static scanners and dependency tools never surface the references because the script tags live in third-party documentation, old repositories, and CMS templates that were never re-deployed. Browser execution therefore occurs against infrastructure the site operator does not control and cannot observe on the server side.
Polyfill.io demonstrated the same pattern in June 2024 when ownership change produced conditional redirects affecting over 110,000 sites; mainstream reputation lists lagged for weeks. CSP reports collected by Report URI in September 2026 later flagged analogous Magecart-style loaders on e-commerce pages where server-side scans returned clean. The common failure is reliance on first-party tooling that cannot see third-party responses conditioned on geography or user-agent.
Operational impact is immediate: any hostname under the wildcard can now read DOM, exfiltrate form data, or chain to secondary loaders without touching origin servers. No breach notification reaches the affected organisations because nothing on their infrastructure changed.
Next step is deployment of report-only CSP headers scoped to the affected domain to surface real-user execution before blocking rules are introduced.
Sentinel: Within 90 days, CSP reports will record at least one malicious execution event from the re-registered domain on more than 50 distinct origins.
Sources (3)
- [1]Primary Source(https://thehackernews.com/2026/09/an-abandoned-cdn-domain-was-re.html)
- [2]Supporting Source(https://sansec.io/research/polyfill-supply-chain-attack)
- [3]Supporting Source(https://report-uri.com/blog/clickfix-csp-alerts)