Bunny CDN Security Incident

Your content delivery might experience minor delays as TLS certificates are reissued across the Bunny.net platform.

Bunny.net, a content delivery network (CDN) provider, experienced a security incident originating from a third-party infrastructure provider. The incident involved unauthorized access to third-party server management software used by the provider, which hosted one of Bunny.net's CDN nodes in Armenia. Upon notification, Bunny.net engineers immediately stopped traffic to the affected server, preserved logs, securely wiped the server, revoked its access, and permanently removed it from their infrastructure. Investigations by both Bunny.net and the provider have found no evidence of unauthorized access to the CDN node or its data. As a precaution, Bunny.net is reissuing all TLS certificates for its platform domains and is in the process of reissuing managed TLS certificates for custom domains, expected to be completed by October 31. Customers managing their own TLS certificates are advised to revoke and reissue them with new private keys.

The incident highlights the ongoing risks associated with supply chain vulnerabilities in cloud infrastructure, where a breach at a single provider can have downstream effects on multiple services. Bunny.net's swift action in isolating and removing the affected server demonstrates a robust incident response protocol, but the need for prolonged TLS certificate reissuance indicates the complexity of securing distributed systems. The situation underscores the shared responsibility model for security, where CDN providers must manage their infrastructure while also advising customers on their own security practices.

This event may prompt other CDN providers and their customers to review their reliance on third-party infrastructure and the security measures in place. The potential exposure of cached content, configurations, and TLS certificates, even without confirmed unauthorized access, emphasizes the critical nature of data security for content delivery. Future monitoring will likely focus on how effectively Bunny.net communicates the completion of certificate reissuance and whether any unforeseen issues arise from this large-scale key rotation.