bunny.net said on its status page on 28 October 2026 (7:40 pm AWST) that last week one of its infrastructure providers reported unauthorised access involving third-party server management software, and that one of its CDN nodes, located in Armenia, was hosted on a server supplied by that provider.

Bunny says that after the provider's alert it stopped routing traffic through the server within 20 minutes, reviewed and preserved the relevant security logs, securely wiped the server, revoked its access to Bunny's other systems and permanently removed it from its infrastructure.

Bunny says its investigation found no evidence of unauthorised access to the CDN node or any of its data, and that the provider has also found no evidence that Bunny's server was accessed but continues to investigate; Bunny says it cannot completely rule out the possibility.

If the node was accessed, Bunny says the potentially exposed information would have been temporarily cached CDN content, Pull Zone configurations and TLS certificates stored on that server; no other customer data, including bunny.net account data, was stored on the server, and no internal systems were affected. As a precaution Bunny revoked and reissued all TLS certificates for its platform domains (b-cdn.net and bunny.run) and began reissuing managed TLS certificates for custom domains.

In an update on 30 October 2026 (2:40 am AWST), Bunny said reissuance of managed certificates for custom domains was ongoing in controlled batches, each with a new private key, and was taking longer than first estimated, with completion now expected by the end of 31 October; existing certificates continue to be served until replaced, and neither Bunny's investigation nor the provider's has found any new evidence of unauthorised access to its server. Bunny does not name the provider. (source: bunny.net status page)