TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Bunny.net says an infrastructure provider reported unauthorized access involving third-party server management software on a server hosting one of its CDN nodes in Armenia. The company removed the server and says neither its investigation nor the provider’s has found evidence that Bunny.net’s server or data was accessed, though access cannot be ruled out.
Bunny.net said on October 28 that it permanently removed a server hosting one of its CDN nodes in Armenia after the server’s infrastructure provider reported unauthorized access involving third-party server management software. Bunny.net says it found no evidence its server or data was accessed, but it cannot rule out that possibility and has taken precautions involving TLS certificates.
The provider notified Bunny.net of the incident “last week,” according to the company’s status-page notice. Bunny.net said its engineering team stopped routing traffic through the server within 20 minutes of receiving the alert. It then reviewed and preserved relevant security logs, securely wiped the server and revoked the server’s access to Bunny.net’s other systems. The server has since been permanently removed from the company’s infrastructure.
Bunny.net said its investigation found no evidence of unauthorized access to the CDN node or data on it. The infrastructure provider also reported finding no evidence that the Bunny.net server was accessed, but its investigation was continuing. The company cautioned that it could not completely rule out access.
If the node had been accessed, Bunny.net identified potentially exposed information as temporarily cached CDN content, Pull Zone configurations and TLS certificates stored on that server. The company said no other customer data, including Bunny.net account data, was stored there, and that no internal systems were affected.
Certificate Precautions for Customers
The disclosure matters to customers because the server hosted a CDN node, which can temporarily handle or store content delivered through the service. Bunny.net has not reported evidence that the node or its data was accessed, but the company’s stated uncertainty means customers cannot treat exposure as definitively ruled out.
Bunny.net said it revoked and reissued all TLS certificates for its platform domains, including b-cdn.net and bunny.run. It also said reissuance of managed certificates for custom domains was underway and expected to be completed within 24 hours of the notice. Customers using managed certificates were told that no action is required. Customers who manage their own certificates were advised to revoke and reissue them using new private keys as a precaution.
Those steps address the possibility that certificates on the affected server could have been exposed; they do not establish that exposure occurred. The distinction is relevant for customers deciding whether to take action: Bunny.net’s notice describes a precaution based on a possibility, not a confirmed compromise of customer certificates or content.
Products Worth Considering
Arlo Pro Wireless Security Camera, 2K HDR, 6th Generation, 4-Camera Kit
eufy Security Video Doorbell E340 Kit with Chime, 2K Resolution and 8GB Local Storage
eufy Security SoloCam E42 4-Camera Kit, 4K Solar Security Cameras with HomeBase 3
As an affiliate, we earn on qualifying purchases.
How the Provider Alert Unfolded
The incident began with a report from an unnamed infrastructure provider about unauthorized access involving third-party server management software. Bunny.net said one of its CDN nodes was hosted on a server supplied by that provider. The company did not say when the provider’s incident began, how the unauthorized access occurred or whether the access involved other systems belonging to the provider.
After receiving the alert, Bunny.net took the server out of traffic, preserved logs for investigation and removed the machine from its infrastructure. It also revoked the server’s access to the company’s other systems. The status-page notice, posted at 11:40 UTC on October 28, 2026, framed those actions as a response to the provider’s report and as measures to limit any potential exposure.
The scope described by Bunny.net is limited to the affected server and the data that might have been present there. The company said account data was not stored on that server and internal systems were not affected. It did not identify the provider or publish technical details about the management software, so the notice does not establish how broad the provider’s incident was beyond the information disclosed.
“Within 20 minutes, we stopped routing traffic through the server.”
— Bunny.net, in its October 28 status-page notice
Access and Exposure Remain Unconfirmed
No unauthorized access to Bunny.net’s server has been confirmed in the notice. Bunny.net and its provider both reported no evidence of access, but Bunny.net explicitly said it could not completely rule out the possibility. The provider’s investigation was still ongoing at publication.
The notice does not specify whether the reported access to management software affected only the provider’s systems or what information, if any, the intruder could reach. It also does not say whether cached content or configuration information was accessed. Bunny.net described those items as potentially exposed only if its node had been accessed; it did not report a confirmed disclosure.
The company did not name the infrastructure provider or provide a detailed incident timeline beyond saying it received the report “last week.” It also had not yet confirmed completion of reissuance for managed TLS certificates on custom domains. The status-page notice said completion was expected within 24 hours, with a further update planned once the process was finished.
Provider Review and Certificate Update
Bunny.net said it was monitoring its infrastructure and working with the affected provider as the investigation continued. It said it would notify customers by email and post on its status page if new findings affected them.
The next stated milestone was completion of reissuance for managed TLS certificates used on custom domains. Bunny.net expected that work to finish within 24 hours of its October 28 notice and said it would post an update afterward. Customers using managed certificates were told no action was required; customers managing their own certificates were advised to revoke and reissue them with new private keys as a precaution.
The scope of any access, if it occurred, will depend on findings from the continuing investigation. Bunny.net had not announced a confirmed compromise of customer data or internal systems in the notice.
Key Questions
What happened in the Bunny.net security incident?
An infrastructure provider reported unauthorized access involving third-party server management software. One Bunny.net CDN node was hosted on a server supplied by that provider, and Bunny.net removed that server from service.
Was Bunny.net customer data accessed?
Bunny.net has not found evidence that its server or data was accessed. The provider also reported no evidence that the server was accessed, but the investigation was ongoing and Bunny.net said it could not completely rule out access.
What information could have been exposed?
If the CDN node was accessed, Bunny.net said potentially exposed information could include temporarily cached CDN content, Pull Zone configurations and TLS certificates stored on the server. The company said account data was not stored there and internal systems were not affected.
Do customers need to replace their TLS certificates?
Customers using Bunny.net-managed certificates were told no action is required. Customers who manage their own certificates were advised to revoke and reissue them with new private keys as a precaution.
When will Bunny.net provide another update?
Bunny.net said it would post a status-page update after managed TLS certificate reissuance for custom domains was complete. It also said it would contact customers by email and update its status page if further investigation findings affected them.
Source: status.bunny.net
