BUG HUNTER TRICKED SSL.COM INTO ISSUING CERT FOR ALIBABA CLOUD DOMAIN IN 5 STEPS

Summary from the TLDR InfoSec newsletter

A security researcher discovered a flaw in SSL.com's domain validation flow that allowed a potential attacker to obtain a certificate for a site they do not control. SSL.com allows for domain validation using a _validation-contactemail TXT record that contains an email, which it then sends a link to. The bug involved SSL.com using the email's domain for validation, regardless of the domain hosting the TXT record.