bunny.net reissues every TLS certificate after a provider breach

bunny.net reissues every TLS certificate after a provider breach

29 October 2026: bunny.net, the Slovenian content delivery network, is revoking and reissuing the TLS certificates it holds for customers after one of its infrastructure providers reported unauthorised access to the server management software it uses. One bunny.net CDN node, in Armenia, ran on a server from that provider. bunny.net says neither it nor the provider has found evidence the node was accessed, but it cannot rule it out, and the node stored cached content, Pull Zone configurations and TLS certificates.

Not yet independently verified. This rests on bunny.net's own status page, which does not name the infrastructure provider or the server management software involved. We have not read the provider's own account or an independent report. We will update this when it can be confirmed, and remove this note.

Twenty minutes to pull the node

The provider's alert came in the week before 28 October, when bunny.net posted the incident. By its account, engineers stopped routing traffic through the Armenian server within 20 minutes, preserved its security logs, wiped it and revoked its access to the rest of the network. The server has been removed permanently. bunny.net says no account data was stored on it and no internal systems were affected.

The certificates are the reason for the work that followed. A CDN edge holds the private keys for every domain it serves over HTTPS, so anyone who copied them could impersonate those sites to visitors whose traffic they could intercept, until the certificates are revoked.

Platform domains first, custom domains in batches

bunny.net revoked and reissued all certificates for its own platform domains, b-cdn.net and bunny.run, straight away. Custom domains on managed certificates took longer than first planned. The 28 October update expected them done within 24 hours; the 29 October update said reissue was running in controlled batches, each with a new private key, and moved completion to the end of 31 October. Existing certificates keep being served until each is replaced, so sites have not gone dark.

Customers on managed certificates have nothing to do. Customers who upload their own certificates to bunny.net are told to revoke and reissue them with new private keys as a precaution. That is the step most likely to be missed: a team that bought a certificate from a commercial authority for an apex domain, uploaded it once and forgot it now has to go back to that authority, revoke it, generate a new key and upload the new pair.

What else may have been on the node

Pull Zone configurations can include origin hostnames and, depending on setup, the headers or tokens a zone uses to authenticate to the origin. bunny.net does not say anything was taken, but teams that put origin secrets into edge rules may want to rotate those too, on the same logic as the certificates. Cached content is whatever the node was serving; for most customers that is public material already.

bunny.net among our hosting listings

We list bunny.net among 201 web hosting companies. The incident is still marked unresolved, and bunny.net has said it will post again once reissue is complete.

Sources

• bunny.net status: Security update regarding one of our infrastructure providers (updates of 28 October 11:40 UTC and 29 October 18:40 UTC), 29 October 2026