Bunny CDN Security Incident(status.bunny.net)
218 points by SondreDag 18 hours ago | 44 comments
tl;dr: Bunny CDN disclosed that an infrastructure provider reported unauthorized access to a server hosting one of its CDN nodes in Armenia. Bunny stopped traffic to the node within 20 minutes, wiped it, and found no evidence of compromise, but as a precaution revoked and reissued all TLS certificates for b-cdn.net and bunny.run domains. Customers managing their own TLS certificates are advised to revoke and reissue them with new private keys; no account data or internal systems were affected.
HN Discussion:
  • ↑Praise for Bunny's prompt and competent incident response
  • ↓Title is misleading since the actual breach was at upstream provider Gcore, not Bunny
  • ↓Criticism of wiping the server instead of preserving evidence for forensic investigation
  • •Concern about blast radius given high-profile customers like php.net and PECL
  • ↓Prior due-diligence red flags about Bunny's secretive security posture make this predictable