CDN provider bunny.net opened a security incident on its status page on Oct 28 and posted an update on Oct 31.

• What happened: the week before, one of its infrastructure providers reported unauthorized access involving third-party server management software. One bunny CDN node, in Armenia, was on a server from that provider. bunny says it stopped routing traffic through the server within 20 minutes of the alert, preserved logs, wiped the server and revoked its access to other systems.
• Possible exposure: neither bunny nor the provider has found evidence the server was accessed, but bunny says it can't rule it out. If it was, cached CDN content, Pull Zone configurations and the TLS certificates stored on that node could have been exposed. bunny says account data was not on the server and internal systems were not affected.
• Response: bunny revoked and reissued certificates for its platform domains (b-cdn.net, bunny.run). On Oct 31 it said all managed custom-domain certificates had been reissued with new private keys and the old ones revoked. It has stopped using the provider and is changing config distribution so each PoP only holds configs and certificates for sites it serves.

What to do: if you uploaded your own TLS certificate to bunny.net, revoke it and issue a new one with a new private key, as bunny recommends. Managed certificates need no action. Review Pull Zone configs for secrets such as origin auth headers or tokens and rotate any you find.