Supply Chain Risk: The netdna-ssl.com Domain Takeover

Security researcher Scott Helme has identified a significant dormant supply chain risk involving the domain netdna-ssl[.]com. Originally the asset domain for MaxCDN (used extensively by WP Engine Legacy Network), the domain was allowed to expire and was re-registered by a third-party in July 2025. This entity now controls wildcard DNS for the entire namespace, including legacy hostnames used to serve JavaScript, CSS, and fonts for thousands of websites.

Technically, the threat is currently pre-positioned but inactive because the new owner's SSL certificates do not yet cover the subdomains used by legacy assets (e.g., *.wpengine.netdna-ssl[.]com). However, a simple configuration change by the new owner would allow them to serve arbitrary malicious code to any site still referencing these URLs. This mirror the 2024 polyfill[.]io attack, where trusted infrastructure changed hands and was subsequently weaponized for large-scale exploitation.

The business impact is high, as Cloudflare Radar ranks the domain in the top 20,000 globally, indicating significant live traffic. Affected sectors likely include any organization running legacy WordPress or WP Engine instances, with confirmed references in repositories for organizations like Mozilla, Kong, and Nextcloud. Immediate remediation is required to remove these dependencies before the 'loaded gun' is fired.