Changes Bunny.net Security update regarding one of our infrastructure providers

Bunny.net: Incident updated: Security update regarding one of our infrastructure providers

Incident updateDownplayed?Normal progress (rule, 100%)Changed 2026-11-04 13:43 UTCstatus.bunny.net

Summary

Summary pending. The diff below shows exactly what changed.

Downplayed?

Vendor rated this none; a Hacker News thread about it drew 224 points and 45 comments. Bunny CDN Security Incident (opens in new tab)

This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.

Incident page: the full timeline of updates

What changed

~~Struck in red~~ is what Bunny.net removed; blue is what they added. Muted text is unchanged context.

AddedUpdatemonitoring2026-11-04 13:38 UTC#1

not present

We can confirm that the revocation of all affected certificates is now complete. Let's Encrypt has published every revocation in its Certificate Revocation Lists (CRLs). Every Let's Encrypt certificate that was on the affected server has been revoked with the reason "key compromise". Browsers and clients that check revocation will now reject the old certificates. The replacement certificates now in use are not affected, and customers don't need to do anything. Our provider's investigation is still ongoing. We will continue to follow up and will share the final outcome once it is complete.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 31
Before captured 12:53 UTC
In the 2026-10-31 checkpoint, timestamped by FreeTSA and DigiCert on Nov 1, 00:41 UTC. Record hash 8be5a43b211d3238…
Download proof
Nov 4
After captured 13:43 UTC
In the 2026-11-04 checkpoint, timestamped by FreeTSA and DigiCert on Nov 5, 00:43 UTC. Record hash 09112895d42d657b…
Download proof

History of this incident

Monday, November 9

1 incident change

Normal progress
20:33Incident
Incident updateSecurity update regarding one of our infrastructure providers

Wednesday, November 4

1 incident change

Normal progress
13:43Incident
Incident updateSecurity update regarding one of our infrastructure providersthis change

Saturday, October 31

1 incident change

Normal progress
12:53Incident
Incident updateSecurity update regarding one of our infrastructure providers

Thursday, October 29

1 rewrite, 1 incident change

Wording only
20:03Edited by the vendor
Security update regarding one of our infrastructure providers
Bunny.net edited its 10-29 18:40 UTC monitoring update about managed TLS certificate reissuance for custom domains. The edit removes “Update -” and leaves the completion estimate truncated at “by the en”; the wording still says reissuance is ongoing in controlled batches with new private keys to avoid content-delivery disruption.
Normal progress
18:43Incident
Incident updateSecurity update regarding one of our infrastructure providers

Cite this

Incident updated: Security update regarding one of our infrastructure providers on Bunny.net’s status page, changed 2026-11-04 13:43 UTC (change 4 of 5).

Title: Incident updated: Security update regarding one of our infrastructure providers
Vendor: Bunny.net
Date: 2026-11-04 13:43 UTC
URL: https://rewindex.com/change/r5583ba72bcea72

All Bunny.net changes Bunny.net profile Markdown JSON