TLDR Tech / News
Attackers Exploited Domain Registries for Fake Google TLS Certificates
Malicious actors gained control of the .gh, .sl, and .as country-code domains, enabling them to issue fraudulent TLS certificates for Google and other major companies. By altering DNS records and nameserver delegations, the attackers successfully bypassed domain verification procedures. Although Chrome has now invalidated these compromised certificates, Google cautioned that users of browsers other than Chrome remain vulnerable because their systems do not incorporate Chrome's security updates for certificate revocation.
Read the full story