"Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider.
After receiving the alert from the affected provider, our engineering team took immediate action. Within 20 minutes, we stopped routing traffic through the server. We then reviewed and preserved the relevant security logs for investigation, securely wiped the server, and revoked its access to our other systems. The affected server has been permanently removed from our infrastructure."
> If you manage your own TLS certificates, we recommend revoking and reissuing them with new private keys as a precaution.
Only if you manage them yourself. If Bunny is managing them for you, they'll roll them for you.
While neither investigation has found any indication of unauthorized access to our server, we cannot completely rule out the possibility.
If unauthorized access to our CDN node did occur, the potentially exposed information would have been: temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that server.
As an additional precaution, we have revoked and reissued all TLS certificates for bunny. net platform domains (b-cdn. net and bunny. run). Reissuance of managed TLS certificates for custom domains is ongoing and is expected to be completed within the next 24 hours. No action is required from customers using managed certificates. We will post a further update on our status page once this process is complete.
If you manage your own TLS certificates, we recommend revoking and reissuing them with new private keys as a precaution.
No other customer data, including bunny. net account data, was stored on the server in question, and no internal systems were affected.
Some time ago my colleague and I were doing some due-diligence on Bunny as a potential service provider.
We asked them some basic security questions, nothing low-level, just some basic high-level overview type of stuff to roughly check if they were following well-known best-practices.
Their response was a consistent and constant "cannot tell you due to security reasons".
That rang alarm bells. Any provider such as them who is not sufficiently confident in their security to be willing and able to discuss security at a high-level perspective is not worthy of trust as far as I am concerned.
Oh right because American tech companies are not equally capable of shitty security.
Remind me, oh yeah ... it was just TODAY we saw that Azure exploit providing full cross-tenant compromise.
A big part of why European companies are turning away from American companies is the sort of MAGA bullshit you just demonstrated.
Oh wait.
As a customer, I couldn't ask anything more. No ambiguity, no downplaying, no word salads. If anything this incident increased my confidence in the company.
eraclide•1h ago
https://lowendtalk.com/discussion/222315/gcore-compromised-v...
The title is heavily misleading.
OneDeuxTriSeiGo•20m ago
NGL it's the exact wording I'd personally like to see from a product that had an infra provider have an incident just so that I can mentally tune in enough to figure out if I need to care.
wbl•5m ago
Bunny is doing the right thing here and owning it.