Bunny CDN discloses security incident
The content delivery network has posted a security incident report on its status page.
What to know
- Bunny CDN disclosed a security incident via its status page on October 30, 2026.
- The incident report circulated rapidly across Hacker News and Mastodon but specific technical details are not available in the provided evidence.
Bunny CDN Content delivery network
How it unfolded 1 development · click the chart to see its coverage articlesposts
-
1
-
2 outlets first by HN Best, 12d ago · also HN Frontpage · read ↗
-
While neither investigation has found any indication of unauthorized access to our server, we cannot completely rule out the possibility. If unauthorized access to our CDN node did occur, the potentially exposed information would have been: temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that server. As an…
2 more of the top 3 · 14 posts in this stretch
-
H
Bunny CDN Security Incident L: https:// status.bunny.net/incidents/p6g f1by9kr7m C: https:// news.ycombinator.com/item?id=5 0308697 posted on 2026.10.30 at 15:05:22 (c=0, p=6)
-
> After receiving the alert from the affected provider, our engineering team took immediate action. Within 20 minutes, we stopped routing traffic through the server. We then reviewed and preserved the relevant security logs for investigation, securely wiped the server, and revoked its access to our other systems. The affected server has been…
-
What people are saying 11 voices from 2 sites · best of 14 · verbatim
- Oct 31
-
Bit surprised our old keys have not yet been revoked, apparently due to letsencrypt rate limiting? Wonder how many thousands of private keys they store on a CDN node
-
At least the statement is not competently written.They write that TLS certificates have potentially be exposed. That doesn't make sense. TLS certifcates are public. Probably they mean private server keys have been potentially be exposed. And after that the certificates are not only useless but dangerous (if the private is really in the hands of…
- Oct 30
-
N
Bunny CDN Security Incident: https:// status.bunny.net/incidents/p6g f1by9kr7m Discussion: http:// news.ycombinator.com/item?id=5 0308697
-
> Prompt and competent response, as expected from bunny.Call me pathologically unbiased, but I doubt this same article written by Cloudflare would get this response.
-
> Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this providerAre they talking about physical security? Someone grabbed the server, etc?Colocation providers usually don't care about security…
-
H
Bunny CDN Security Incident Link: https:// status.bunny.net/incidents/p6g f1by9kr7m Discussion: https:// news.ycombinator.com/item?id=5 0308697
-
php.net is on Bunny to my knowledge and so is PECL for example. Great potential for compromised packages if this hadn't been caught , but I don't know the blast radius since the victim would need to connect to this particular CDN
-
Sadly this is entirely predictable.Some time ago my colleague and I were doing some due-diligence on Bunny as a potential service provider.We asked them some basic security questions, nothing low-level, just some basic high-level overview type of stuff to roughly check if they were following well-known best-practices.Their response was a…
-
It looked like competent,but some of the events look really bad for the company. Especially the fact that TLS certificates that customers entrusted bunny now need to be revoked by the customers themselves. This detail was at the very last of the email I got and it was the only part I did not like, because it means customer secrets were indeed…
-
Prompt and competent response, as expected from bunny."Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider.After receiving the alert from the affected provider, our engineering team…
-
Bunny used Gcore in Armenia. Gcore themselves got hacked, not Bunny. Bunny was just an affected downstream, in only one of their POPs.https://lowendtalk.com/discussion/222315/gcore-compromised-v...The title is heavily misleading.