Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Breaches & attacks
LiveMediumPartly patchedBreaches & attacks

bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificates

bunny.net CDN

On Oct 28 2026, CDN company bunny.net said one of its infrastructure providers reported unauthorized access involving third-party server management software. One bunny.net CDN node, in Armenia, ran on a server from that provider. bunny.net stopped routing traffic through it within 20 minutes, wiped it and removed it for good. Neither bunny.net nor the provider has found evidence the node was accessed, but bunny.net can't rule it out; if it was, cached CDN content, Pull Zone configurations and TLS certificates stored on that server could have been exposed. bunny.net revoked and reissued certificates for its own b-cdn.net and bunny.run domains and is reissuing managed custom-domain certificates with new private keys, expected to finish by the end of Oct 31. It says no account data was on the server and no internal systems were affected.

Why this severity: Precautionary: no evidence of access found, but TLS private keys on the node can't be ruled out as exposed

Started
Oct 28, 2026

Follow this incident

Discuss on X ↗

Affected

  • bunny.net CDN customers whose content, Pull Zone configs or TLS certificates were on the Armenia CDN node

Fixed in

No fixed release yet

Timeline2

  1. bunny.net says reissuance of managed custom-domain TLS certificates with new private keys is going in batches and should finish by the end of Oct 31; no new evidence of access to its server.

  2. bunny.net discloses that an infrastructure provider reported unauthorized access involving third-party server management software; bunny.net's Armenia CDN node ran on a server from that provider. It stopped routing traffic through it within 20 minutes, wiped and removed the server, and revoked and reissued all TLS certificates for b-cdn.net and bunny.run.

Advisories1

News & write-ups1

Notes & caveats

bunny.net hasn't named the infrastructure provider or the server management software. Managed certificate reissuance was still in progress as of Oct 29 18:40 UTC.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot