Three hijacked country registries minted counterfeit TLS certificates for Google

On 6 October 2026, Google revealed that attackers had seized the .gh, .sl and .as registries, rewrote DNS records, and obtained unauthorized HTTPS certificates for Google and several other major brands. Domain owners should monitor Certificate Transparency logs and publish restrictive CAA records, because browser-side blocking does not protect non-browser clients.