We're reaching out to communicate you of a safety event involving one of our infrastructure providers, the steps we've taken, and what this method for you. - What happened and how we responded Last week, one of our infrastructure providers reported unauthorized admission involving third-party server administration software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider. After receiving the vigilant from the affected provider, our engineering squad took contiguous action. Within 20 minutes, we stopped routing traffic through the server. We afterward reviewed and preserved the applicable safety logs for investigation, securely wiped the server, and revoked its admission to our another systems. The affected server has been permanently removed from our infrastructure. Our inquiry established no evidence of unauthorized admission to the CDN node or any of its data. The infrastructure provider has additionally established no evidence that our server was accessed, but continues to examine the incident. - What this method for your data While neither inquiry has established any sign of unauthorized admission to our server, we cannot entirely regulation out the possibility. If unauthorized admission to our CDN node did occur, the possibly exposed data would have been: temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that server. As an additional precaution, we have revoked and reissued all TLS certificates for bunny.net phase domains (b-cdn.net and bunny.run). Reissuance of managed TLS certificates for tradition domains is ongoing and is expected to be completed inside the next 24 hours. No act is required from customers using managed certificates. We volition article a additional update on our position leaf formerly this procedure is complete. If you oversee your own TLS certificates, we propose revoking and reissuing them alongside new personal keys as a precaution. No another client data, including bunny.net document data, was stored on the server in question, and no inner systems were affected. - What happens next We’re closely monitoring our infrastructure and operating alongside the affected provider as the inquiry continues. Should any new findings power our customers, we volition provision an update via email and on our position page. At bunny.net, we comprehend the rely you location in us to keep your satisfied secure, and we obtain that duty seriously. If you have any questions or need assistance alongside managing your TLS certificates, our assistance squad volition be blessed to assist.
Posted Oct 28, 2026 - 11:40 UTC
