Technology1 min read

Bunny CDN Security Incident

By · Published by Everything Blog

In short

Bunny CDN acted within 20 minutes of an alert to halt traffic, wipe the affected Armenian server, and permanently decouple it from internal operations. Both the company and the provider found no evidence that cached files or system data were intercepted, but the risk could not be completely dismissed. Potential exposure was confined strictly to cached traffic, Pull Zone configurations, and localized TLS keys rather than central account databases. To protect users, the company began reissuing custom domain certificates and urged clients managing private keys to execute immediate rotations.

Key points

  • The provider swiftly contained the incident by fully decommissioning the singular comprom…: The provider swiftly contained the incident by fully decommissioning the singular compromised node from the global routing network.
  • Bunny CDN has reissued all TLS certificates for platform domains and is updating managed…: Bunny CDN has reissued all TLS certificates for platform domains and is updating managed custom domain credentials.
  • Customers managing their own TLS certificates should immediately revoke them and generate…: Customers managing their own TLS certificates should immediately revoke them and generate replacements using brand-new private keys.

Sources checked by our analysis pipeline: 1

We're reaching out to inform you of a security incident involving one of our infrastructure providers, the steps we've taken, and what this means for you.

- What happened and how we responded

Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider.

After receiving the alert from the affected provider, our engineering team took immediate action. Within 20 minutes, we stopped routing traffic through the server. We then reviewed and preserved the relevant security logs for investigation, securely wiped the server, and revoked its access to our other systems. The affected server has been permanently removed from our infrastructure.

Our investigation found no evidence of unauthorized access to the CDN node or any of its data. The infrastructure provider has also found no evidence that our server was accessed, but continues to investigate the incident.

- What this means for your data

While neither investigation has found any indication of unauthorized access to our server, we cannot…

Technology