Bunny.net, a content delivery network provider, disclosed that one of its CDN nodes — hosted in Armenia on infrastructure supplied by a third-party provider — was potentially exposed after that provider reported unauthorized access to its server management software. The company contained the incident within 20 minutes of receiving the alert, pulling traffic from the affected node, preserving logs, wiping the server, revoking its credentials, and permanently decommissioning it. Neither Bunny.net's own investigation nor the infrastructure provider's ongoing review has found evidence that the CDN node was actually accessed. But the company correctly refuses to rule it out entirely. If unauthorized access did occur, the exposure surface would have included temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that server — not account data or internal systems. The most operationally significant response is the blanket revocation and reissuance of all TLS certificates for Bunny.net platform domains (b-cdn.net and bunny.run), with managed custom-domain certificates being reissued on a rolling basis within 24 hours. Customers managing their own TLS certificates are advised to rotate them with new private keys. This is the correct conservative posture: treat key material as potentially compromised even absent proof of exfiltration. The incident is a textbook illustration of supply-chain risk in cloud infrastructure. Bunny.net did not suffer a direct breach — its exposure was inherited from a vendor's vendor (third-party server management software used by the infrastructure provider). Every layer of outsourcing adds an attack surface the customer cannot directly audit or control. A CDN provider hosting a node on someone else's metal, managed by someone else's software, is three trust boundaries deep. The 20-minute response time and the decision to permanently remove the node rather than remediate and redeploy suggest mature incident response. The transparent disclosure — including explicit acknowledgment of what could not be ruled out — is above the industry norm for incidents with no confirmed data exposure. Most companies in this position quietly rotate keys and say nothing. The Armenia detail matters for threat modeling but not for technical response. What matters is the structural pattern: small CDN providers necessarily rely on colocation and hosting partners across dozens of jurisdictions, each with its own security posture. The incident did not expose a weakness unique to Bunny.net — it exposed a weakness inherent to the distributed infrastructure model that every CDN operates under. For customers, the action items are narrow: rotate self-managed TLS certificates, monitor the status page for completion of managed certificate reissuance, and — for those with compliance obligations — document the incident for audit trails. The broader takeaway is that supply-chain security audits should extend to the infrastructure providers of your infrastructure providers, a depth most organizations never reach.
