Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing request to restore a promotional landing page from three years ago revealed a serious but common DNS hygiene problem. The team opened the original URL and encountered a completely unrelated website, even though the browser displayed the company's own domain name and a valid TLS padlock.
The original page had been hosted on external infrastructure using a project-specific name such as company-promo-2023. A CNAME record was created in the corporate DNS zone to map the promotional subdomain to that external address. When the campaign ended, the hosting project was deleted, yet the DNS record was never removed.
How dangling records form
External hosting platforms assign project names on a first-come, first-served basis. Once the original project is deleted, the name becomes available for anyone to register. Because the corporate CNAME still exists, any new registrant instantly receives traffic intended for the company's subdomain and obtains an automatically issued TLS certificate.
Standard monitoring misses these records. Availability checks only test known applications, and DNS resolvers return addresses even for non-existent projects when the hosting provider uses a wildcard record such as *.github.io.
Security impact
- Cookies set for the parent domain (for example, .example.com) are sent to any subdomain, allowing the new owner to receive session tokens.
- Subdomains often remain in Content-Security-Policy, CORS headers, OAuth redirect lists, and proxy rules long after the original service is gone.
- Attackers can complete domain-ownership challenges that rely on placing a file on the host.
The recommended cleanup process begins with exporting the entire zone from every DNS provider, assigning explicit owners and business justifications to each record, and validating external CNAME targets by checking the actual HTTP response rather than DNS resolution alone. Records whose owners cannot be identified are treated as candidates for immediate deletion.
Related articles
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw is a type confusion issue tied to the Maglev compiler and optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Successful exploitation allows a remote attacker to execute arbitrary code within the browser sandbox after a victim visits a specially crafted HTML page, a technique commonly seen in malvertising and compromised-site campaigns. The fix is included in Chrome 152.0.7977.82 and later for Windows, macOS, and Linux, and the update also resolves a total of twelve vulnerabilities. The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will require corresponding updates from their respective vendors.
CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog, Including SonicWall and LiteLLM Flaws Targeting AI Infrastructure
CISA has added seven vulnerabilities confirmed to be exploited in the wild to its Known Exploited Vulnerabilities catalog, with two carrying CVSS scores of 10.0. The list includes critical issues in SonicWall SMA 1000 devices, JFrog Artifactory, Kestra workflow engine, and LiteLLM AI gateway components. Attackers are now systematically targeting AI infrastructure to steal large language model API keys and configuration data from databases such as LiteLLM_ProxyModelTable. Qilin ransomware operators have already chained LiteLLM flaws for remote code execution and data theft. CISA has set a 48-hour remediation deadline for federal agencies, underscoring the urgency for all organizations running these components.
Critical Vulnerabilities Patched in VMware Workstation and Fusion Allowing Host Code Execution
Broadcom has disclosed two vulnerabilities in VMware Workstation and VMware Fusion rated as critical and important respectively. CVE-2026-59346 is an integer overflow flaw in the VMXNET3 virtual network adapter that can be exploited by a local administrator inside a virtual machine to execute arbitrary code on the host system, carrying a CVSS v3.1 base score of 9.3. CVE-2026-59347 is a stack-based buffer overflow in the HGFS file system that permits code execution on the host as the VMX process with a CVSS score of 8.1. Both issues were privately reported and affect users who run virtual machines with local administrative privileges. The flaws have been addressed in VMware Workstation 26H1u1 and VMware Fusion 26H1u1, and Broadcom urges immediate updates via advisory VMSA-2026-0007.