rewindex

ChangesBunny.netSecurity update regarding one of our infrastructure providers

Bunny.net: Incident updated: Security update regarding one of our infrastructure providers

Incident updateDownplayed?Normal progress (rule, 100%)Changed status.bunny.net (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Downplayed?

Vendor rated this none; a Hacker News thread about it drew 224 points and 45 comments. Bunny CDN Security Incident (opens in new tab)

This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.

Incident page: the full timeline of updates

What changed

Struck in red is what Bunny.net removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: monitoring
After: resolved
AddedResolved time#2
Before: not present
After: 2026-11-09 20:22 UTC
AddedUpdateresolved#3
Before: not present
After: All remediation work on our side is complete. Every certificate we manage through Let's Encrypt for the affected hostnames has been reissued, and the previous certificates have been revoked and published in Let's Encrypt's Certificate Revocation Lists (CRLs). If you uploaded your own custom certificate: as mentioned in our earlier updates, please make sure you have replaced it with a new certificate and private key, and asked your certificate authority to revoke the old one. We can't do this for you. Until you do, the old certificate and its private key should be treated as compromised. We are closing this incident because no further action is required on our side. Our provider's investigation into the root cause is still ongoing. When we receive their final report, we will email affected customers directly with a summary of the findings. Thank you for your patience while we worked through this.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Monday, November 9

1 incident change

Wednesday, November 4

1 incident change

Saturday, October 31

1 incident change

Thursday, October 29

1 rewrite, 1 incident change

Cite this

Incident updated: Security update regarding one of our infrastructure providers on Bunny.net’s status page, changed 2026-11-09 20:33 UTC (change 5 of 5).

Title
Incident updated: Security update regarding one of our infrastructure providers
Vendor
Bunny.net
Date
URL
https://rewindex.com/change/rcd2127c61b271c

All Bunny.net changesBunny.net profileMarkdownJSON