---
title: bunny.net reissues TLS certificates after a hosting provider's server-management breach touched its Armenia CDN node | ctxsec
url: https://ctxsec.com/items/bunny-net-infrastructure-provider-intrusion-armenia-node-tls-reissue
description: "bunny.net says one of its infrastructure providers reported unauthorized access through third-party server management software, and one bunny CDN node in Armenia ran on that provider's hardware. No access to the node has been found, but cached content, Pull Zone configs and TLS certificates on it could have been exposed, so bunny reissued its platform and managed custom-domain certificates. Customers with their own certificates should reissue them."
status: "official (bunny.net status page, Oct 28 to Oct 31); no evidence of access found, not ruled out"
published: 2026-10-31
---

> bunny.net says one of its infrastructure providers reported unauthorized access through third-party server management software, and one bunny CDN node in Armenia ran on that provider's hardware. No access to the node has been found, but cached content, Pull Zone configs and TLS certificates on it could have been exposed, so bunny reissued its platform and managed custom-domain certificates. Customers with their own certificates should reissue them.

[← Cybersecurity News](/news) · [markdown](/items/bunny-net-infrastructure-provider-intrusion-armenia-node-tls-reissue.md)

official (bunny.net status page, Oct 28 to Oct 31); no evidence of access found, not ruled out

2026-10-31

### bunny.net reissues TLS certificates after a hosting provider's server-management breach touched its Armenia CDN node

CDN provider **bunny.net** opened a security incident on its status page on **Oct 28** and posted an update on **Oct 31**.

- **What happened:** the week before, one of its infrastructure providers reported unauthorized access involving third-party server management software. One bunny CDN node, in **Armenia**, was on a server from that provider. bunny says it stopped routing traffic through the server within 20 minutes of the alert, preserved logs, wiped the server and revoked its access to other systems.
- **Possible exposure:** neither bunny nor the provider has found evidence the server was accessed, but bunny says it can't rule it out. If it was, cached CDN content, Pull Zone configurations and the TLS certificates stored on that node could have been exposed. bunny says account data was not on the server and internal systems were not affected.
- **Response:** bunny revoked and reissued certificates for its platform domains (`b-cdn.net`, `bunny.run`). On Oct 31 it said all managed custom-domain certificates had been reissued with new private keys and the old ones revoked. It has stopped using the provider and is changing config distribution so each PoP only holds configs and certificates for sites it serves.

**What to do:** if you uploaded your own TLS certificate to bunny.net, revoke it and issue a new one with a new private key, as bunny recommends. Managed certificates need no action. Review Pull Zone configs for secrets such as origin auth headers or tokens and rotate any you find.

Sources: [bunny.net status: Security update regarding one of our infrastructure providers (Oct 28, updated Oct 31)](https://status.bunny.net/)