If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately

Researchers report that the cdn.polyfill.io domain—recently sold to an entity called Funnull—is being used in a web supply‑chain attack to inject malicious, dynamically generated JavaScript into pages that load polyfills; over 100,000 sites are affected, with observed mobile redirects to fraudulent sites and other malware behaviors, prompting advisories to remove the domain and use trusted mirrors or CDNs as mitigation.