Bunny CDN, a content delivery network (CDN) provider, recently addressed a security incident involving one of its infrastructure nodes. According to a status update from the company, a third-party infrastructure provider reported unauthorized access to a server using third-party management software. This specific server hosted one of Bunny's CDN nodes in Armenia. Upon receiving the alert, Bunny's engineering team took action to stop routing traffic through the affected server within 20 minutes. The company subsequently preserved security logs for investigation, wiped the server, and revoked its access to all other internal systems. The node has been permanently removed from their infrastructure.
While Bunny CDN stated that investigations have not yet found definitive evidence of unauthorized access to their specific server, they acknowledged the possibility of exposure. If a breach occurred, the potentially compromised data could include temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that specific node. In response, the company has proactively revoked and reissued TLS certificates for its primary platform domains, including b-cdn.net and bunny.run. For customers who use managed certificates, Bunny is handling the reissuance automatically; however, customers who manage their own certificates are advised to revoke and reissue them with new private keys as a precaution.
The incident has sparked discussion regarding the security posture of third-party infrastructure providers and the implications for downstream users. Some observers noted that the incident appears to stem from a breach of the infrastructure provider (identified by some as Gcore) rather than a direct breach of Bunny's own systems. However, the necessity for customers to manually rotate their own certificates has raised concerns about the potential compromise of customer secrets. The incident highlights the risks inherent in multi-layered infrastructure, where a vulnerability in a provider's management software can impact the security of the services hosted on that hardware. No other customer data was reported as compromised in the incident report.