Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing request to restore a promotional landing page from three years ago revealed a serious but common DNS hygiene problem. The team opened the original URL and encountered a completely unrelated website, even though the browser displayed the company's own domain name and a valid TLS padlock.
The original page had been hosted on external infrastructure using a project-specific name such as company-promo-2023. A CNAME record was created in the corporate DNS zone to map the promotional subdomain to that external address. When the campaign ended, the hosting project was deleted, yet the DNS record was never removed.
How dangling records form
External hosting platforms assign project names on a first-come, first-served basis. Once the original project is deleted, the name becomes available for anyone to register. Because the corporate CNAME still exists, any new registrant instantly receives traffic intended for the company's subdomain and obtains an automatically issued TLS certificate.
Standard monitoring misses these records. Availability checks only test known applications, and DNS resolvers return addresses even for non-existent projects when the hosting provider uses a wildcard record such as *.github.io.
Security impact
- Cookies set for the parent domain (for example, .example.com) are sent to any subdomain, allowing the new owner to receive session tokens.
- Subdomains often remain in Content-Security-Policy, CORS headers, OAuth redirect lists, and proxy rules long after the original service is gone.
- Attackers can complete domain-ownership challenges that rely on placing a file on the host.
The recommended cleanup process begins with exporting the entire zone from every DNS provider, assigning explicit owners and business justifications to each record, and validating external CNAME targets by checking the actual HTTP response rather than DNS resolution alone. Records whose owners cannot be identified are treated as candidates for immediate deletion.
Related articles
CISA Adds Adobe Commerce and WSO2 Vulnerabilities to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-71362 affects Adobe Commerce and Magento, enabling attackers to escalate privileges through an authorization bypass flaw. CVE-2026-5430 impacts multiple WSO2 API management products and allows JWT authentication bypass, leading to administrator account takeover and remote code execution via arbitrary file uploads. Adobe issued an advisory in August 2026 recommending patches within 30 days, while WSO2 warned about the issue in May 2026. CISA has set a September 27, 2026 deadline for federal agencies to apply updates and investigate potential compromises.
Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access
Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.
Check Point Patches Critical Zero-Day CVE-2026-93616 Enabling Unauthenticated Remote Code Execution on Management Servers
Check Point has addressed a critical zero-day vulnerability tracked as CVE-2026-93616 with a CVSS score of 9.8 that allowed remote unauthenticated attackers to upload and execute arbitrary scripts on management servers. The flaw combined directory traversal with insecure file handling, enabling attackers to escape the intended directory and place scripts in executable locations. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Targeted attacks were observed starting July 23 before public disclosure, though exploitation remained limited. Vulnerable versions span multiple R82, R81, and R80 releases, with fixes now available through specific hotfixes and Jumbo Takes. Administrators are advised to apply patches immediately, place management servers behind a Security Gateway, and restrict TCP port 19009 access. Detection guidance includes reviewing cpm.elg logs for unusually long usernames and ReflectionUtils errors containing directory traversal sequences.
GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws
GitLab has issued critical security updates for its development platform to address 11 vulnerabilities across Community Edition and Enterprise Edition. The patches cover versions 19.4.1, 19.3.3, and 19.2.7 and were released on September 23, 2026. Two vulnerabilities rated Critical allow authenticated users to achieve arbitrary code execution on the server. CVE-2026-89078 involves a double-free issue in CI/CD configuration parsing triggered by crafted regular expressions, while CVE-2026-93577 is an integer overflow in the regular expression compiler. Additional High-severity issues include cross-site scripting in merge request diffs and unauthorized access to sensitive CI/CD variables via the Duo AI job troubleshooting feature. The update also resolves five Medium and two Low severity flaws.