A newly disclosed vulnerability class called ‘Underminr’ allows attackers to route malicious command-and-control traffic through shared CDN infrastructure, making it appear legitimate to security tools that inspect only connection metadata. Because the technique abuses CDN architecture rather than exploiting a discrete software flaw, no patch exists, and an estimated 88 million domains fall within the affected scope. This signals a broader shift in attacker tradecraft: adversaries are increasingly hiding inside trusted cloud and delivery infrastructure, eroding the value of perimeter controls and DNS-based filtering.