For an unknown stretch of time, anyone could have registered a domain that ran part of the DNS of South Korea’s National Cyber Security Center. That is the agency where people report security holes in government systems.
Developer Antonio Cheong described the problem in a blog post dated Sunday, November 8. Two of the agency’s three nameservers, ns1.aegis-k.com and ns2.aegis-k.com, sat on a domain that had expired and was free to register. The agency’s domain, ncsc.go.kr, also had no DNSSEC, the signature system that lets resolvers reject forged answers.
South Korea fixed it within about two months of his report, Cheong writes. His scan turned up around 21 such cases on government domains worldwide, and he says the other countries “aren’t really responding.”
Source: Privacy Affairs · 2026-11-08