# bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificates · pwn.watch > On Oct 28 2026, CDN company bunny.net said one of its infrastructure providers reported unauthorized access involving third-party server management software. One bunny.net CDN node, in Armenia, ran on a server from that provider. bunny.net stopped routing traffic through it within 20 minutes, wiped it and removed it for good. Neither bunny.net nor the provider has found evidence the node was accessed, but bunny.net can't rule it out; if it was, cached CDN content, Pull Zone configurations and TLS certificates stored on that server could have been exposed. bunny.net revoked and reissued certificates for its own b-cdn.net and bunny.run domains and is reissuing managed custom-domain certificates with new private keys, expected to finish by the end of Oct 31. It says no account data was on the server and no internal systems were affected. Page: https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026 · generated 2026-10-30T22:14:28.838Z ## Status - Severity: medium · status: live · patch: partial - Product: bunny.net CDN - Started: 2026-10-28 - Affected: bunny.net CDN customers whose content, Pull Zone configs or TLS certificates were on the Armenia CDN node ## Follow this incident - RSS (one item per update): https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026.json - This file: https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026/llms.txt ## Updates (newest first) - 2026-10-29: bunny.net says reissuance of managed custom-domain TLS certificates with new private keys is going in batches and should finish by the end of Oct 31; no new evidence of access to its server. (https://status.bunny.net/incidents/p6gf1by9kr7m) - 2026-10-28: bunny.net discloses that an infrastructure provider reported unauthorized access involving third-party server management software; bunny.net's Armenia CDN node ran on a server from that provider. It stopped routing traffic through it within 20 minutes, wiped and removed the server, and revoked and reissued all TLS certificates for b-cdn.net and bunny.run. (https://status.bunny.net/incidents/p6gf1by9kr7m) ## Fix brief # Security brief: bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificates Source: https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026 · status: live · severity: medium · updated Oct 30, 2026, 19:14 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 28 2026, CDN company bunny.net said one of its infrastructure providers reported unauthorized access involving third-party server management software. One bunny.net CDN node, in Armenia, ran on a server from that provider. bunny.net stopped routing traffic through it within 20 minutes, wiped it and removed it for good. Neither bunny.net nor the provider has found evidence the node was accessed, but bunny.net can't rule it out; if it was, cached CDN content, Pull Zone configurations and TLS certificates stored on that server could have been exposed. bunny.net revoked and reissued certificates for its own b-cdn.net and bunny.run domains and is reissuing managed custom-domain certificates with new private keys, expected to finish by the end of Oct 31. It says no account data was on the server and no internal systems were affected. Severity detail: Precautionary: no evidence of access found, but TLS private keys on the node can't be ruled out as exposed - Product: bunny.net CDN ## Affected versions - bunny.net CDN customers whose content, Pull Zone configs or TLS certificates were on the Armenia CDN node ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you use bunny.net with your own uploaded TLS certificates: revoke them and issue new ones with new private keys. Managed certificates are being replaced automatically and need no action. Review Pull Zone configs for anything sensitive (such as origin auth headers or tokens) and rotate those as a precaution. ## Latest updates - Oct 29, 2026: bunny.net says reissuance of managed custom-domain TLS certificates with new private keys is going in batches and should finish by the end of Oct 31; no new evidence of access to its server. - Oct 28, 2026: bunny.net discloses that an infrastructure provider reported unauthorized access involving third-party server management software; bunny.net's Armenia CDN node ran on a server from that provider. It stopped routing traffic through it within 20 minutes, wiped and removed the server, and revoked and reissued all TLS certificates for b-cdn.net and bunny.run. ## Advisories - [Security update regarding one of our infrastructure providers](https://status.bunny.net/incidents/p6gf1by9kr7m) (bunny.net) ## Write-ups & news - [Bunny CDN Security Incident (discussion)](https://news.ycombinator.com/item?id=50308697) ## Caveats bunny.net hasn't named the infrastructure provider or the server management software. Managed certificate reissuance was still in progress as of Oct 29 18:40 UTC. --- Machine-readable: https://pwn.watch/i/bunny-net-armenia-cdn-node-provider-compromise-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.