TL;DR: the Polyfill.io supply chain attack
- The real number: 490,000+ sites affected, not the 100,000 everyone quotes. That number was just PublicWWW's default result cap.
- Why WAFs missed it: The compromise was in the browser supply chain, not the origin. WAFs never saw it because an allowlisted domain served the malicious code.
- What PCI DSS covers: This is exactly the attack 6.4.3 and 11.6.1 were written for. Both enforced from 31 March 2025.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
Take action now
The Polyfill service itself is still solid. You can host your own version in a safe and controlled environment without issue. The issue lies within the domain cdn.polyfill[.]io which should immediately be removed from your sites.
Third-party resources are in a very powerful position and thus a high value target for bad actors. CDNs hosting third-party scripts are subject to attack. In 2021 cdnjs itself had certain vulnerabilities exposed.
Editor's note (2026): The section below describes cside's original 2024 architecture. cside now performs full client-side script monitoring, a single first-party JavaScript snippet that observes what third-party scripts actually do in real visitors' browsers, including the conditional, geo- and time-gated payloads (like this one) that show clean code to scanners and crawlers. The script-delivery proxy described below was retired in early 2026.
With cside, browser-fetched third-party dependencies are no longer made directly to the third party. Instead, they travel through the cside detection and optimization engine. Making it able to detect highly targeted attacks against a small percentage of users. If anything malicious is detected, we block it before it gets served to the end-user.
Our detection engine is able to spot this change in the actual code and block it from happening. If a site running cside would also have had the cdn.polyfill[.]io try to load a tampered script, it would not have been served to the user.
You would have been alerted right away and would've known the second this was going on. We also save the script's code and deobfuscate it so you can check what it does for yourself.
At the time of writing this article, threat feeds do not flag this domain. That shows relying solely on those is risky business, as we mentioned here.
A redirect was only what was caught. We later explained why the Polyfill attack was more than just a redirect attack, and in 2025 OFAC sanctioned Funnull, the company behind the domain.
Get started using cside for free and protect yourself today.
Related reading
- What is a supply chain attack: the browser supply chain explained
- Magecart attacks explained: how web skimming works
- What is formjacking?
- Online credit card skimming
- JavaScript security vulnerabilities and CSP evasion
- Third-party script monitoring
- What is client-side security
- How to comply with PCI 6.4.3 and PCI 11.6.1
