Bunny CDN Security Incident

What it is

Bunny.net posted a status-page notice on 28 October 2026 (11:40 UTC) about unauthorized access at an infrastructure provider. The provider's report said the access involved third-party server management software. The affected machine was a provider-supplied server hosting one bunny.net CDN node in Armenia. The page does not name the provider or the software.

Preconditions / Affected

Exposure is only possible, not confirmed. Neither bunny.net nor the provider found evidence that the server was accessed, but bunny.net says it cannot rule it out. The provider's investigation is still open. If access did occur, the data on the node would have been:

• temporarily cached CDN content
• Pull Zone configurations
• TLS certificates stored on that server

Bunny.net states that no other customer data, including account data, was on the server, and that no internal systems were affected.

What to do

Action depends on how you handle certificates:

• Managed certificates: no action is required. Bunny.net revoked and reissued all certificates for its platform domains, b-cdn.net and bunny.run. Reissuance of managed certificates for custom domains was still in progress at posting and was expected to finish within 24 hours (by about 29 October 2026). A further status-page update is promised when it completes, so check that page before assuming it is done.
• Your own certificates: revoke and reissue them with new private keys. Reusing the old key does not help, because the private key is what may have been exposed. Bunny.net support offers help with this.
• Pull Zone configurations: the page gives no instruction beyond the certificate steps. If any contain secrets such as origin credentials or tokens, that is a judgement call for the reader.

Caveats

Bunny.net says it stopped routing traffic to the server within 20 minutes of the provider's alert. It preserved the security logs, wiped the server, revoked its access to other systems and permanently removed it from its infrastructure. The page gives no dates for the compromise or the alert beyond "last week". Further findings that affect customers will be sent by email and posted on the status page.