Skip to content
NewA calmer, faster ZeroHour
Data breachmedium

Bunny CDN isolates Armenia node after provider reports unauthorized access

Original title: Bunny CDN Security Incident

Hacker News · securityby SondreDag ()2 min read1
Read at status.bunny.net Hacker News · 20 points · 3 comments
AI summary · x-ai/grok-4.7Summaries by Vani AI

Investigators found no access to the node, but Bunny is reissuing TLS certificates in case cached content or keys were exposed.

Bunny.net said an infrastructure provider reported unauthorized access to third-party server management software last week. One CDN node in Armenia ran on a server from that provider. Bunny stopped routing traffic within 20 minutes, wiped the server, and revoked its access. Neither Bunny nor the provider found evidence the node was accessed, though both say that possibility cannot be fully excluded.

Unconfirmed: Neither investigation confirmed access to the Bunny server, and the provider's review is still ongoing.

Key facts
  • Traffic through the node was stopped within 20 minutes of the alert.
  • Possible exposure covers cached content, Pull Zone configurations, and TLS certificates.
  • Certificates for b-cdn.net and bunny.run were revoked and reissued.
  • Managed custom-domain certificate reissuance was expected within 24 hours of the October 28 notice.
  • Account data and other internal systems were not on the affected server.
Security assessment · AI, from the article

Impact: possible exposure of cached content, configs, and TLS certificates

What to do
  1. 1.Customers managing their own TLS certificates should revoke and reissue them with new private keys.
  2. 2.No customer action is required for Bunny-managed certificates.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
bunny-cdncdntlscertificate-reissueinfrastructure
Vendors
Bunny.net
Products
Bunny CDN
Countries
Armenia

From the original article

2 min read at status.bunny.net

We're reaching out to inform you of a security incident involving one of our infrastructure providers, the steps we've taken, and what this means for you. - What happened and how we responded Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider.

Hacker News · security

By SondreDag · status.bunny.net

Read the full article at Hacker News · security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.