So looks like

1) Top level CC DNS entries were hacked

2) CAA entries were removed (I assume google had them -- they do now CAA 0 issue "pki.goog"

3) These were then used to verify issuing certificates against major CAs (letsencrypt etc) - for example by creating a new CNAME record for DNS verification

Looking at google.as specifically shows Let's Encrypt issuing a certificate on 2026-09-27

https://ctlogs.dev/search?q=google.as

Google normally issues certificates with "Google Trust Services", presumably their in house CA which all browsers trust, but the only way to limit issuing to Google is with the CAA record.

If you hijack DNS, you hijack certificate issuing. As several CAs exist with no business relationship to identify the real person asking for the certificate, you can do this anonymously. (If CAs required verification then you'd just have to chain this with the stolen credentials of someone who uses that CA so wouldn't be a major obstacle)

From what I can tell (and the article conflates this with the diginoir so implies it), this was NOT a compromise of a Certificate Authority