Bunny.net通报其一家基础设施提供商的第三方服务器管理软件发生未授权访问事件，受影响的CDN节点位于亚美尼亚 1。该事件发生在上周，工程团队在收到警报后20分钟内停止通过该服务器路由流量，并将受影响服务器永久移除出基础设施 1。调查未发现CDN节点或其数据被未经授权访问的证据，但潜在暴露的信息包括临时缓存的CDN内容、Pull Zone配置以及存储在该服务器上的TLS证书 1。
作为预防措施，Bunny.net已撤销并重新颁发bunny.net平台域名（b-cdn.net和bunny.run）的所有TLS证书 1。自定义域的托管TLS证书重新颁发工作正在进行中，预计在未来24小时内完成 1。公司建议自行管理TLS证书的客户也撤销并重新颁发证书及新私钥 1。
Bunny.net has disclosed a security incident involving unauthorized access to third-party server management software provided by an infrastructure partner, affecting a content delivery network (CDN) node located in Armenia 1. The event occurred during the previous week and was reported on October 28, 2026 1. In response to the alert, Bunny’s engineering team halted traffic routing through the compromised server within 20 minutes 1. Subsequently, the affected server was permanently removed from the company’s infrastructure, with remediation steps including log reviews, data wiping, and revocation of access privileges 1.
Although investigations revealed no evidence that the CDN node or its associated data were accessed without authorization, Bunny implemented precautionary measures due to the potential exposure of temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on the server 1. The company has revoked and reissued all TLS certificates for its platform domains, specifically b-cdn.net and bunny.run 1. The reissuance of managed TLS certificates for custom domains is currently underway and is expected to be completed within the next 24 hours 1. Customers managing their own TLS certificates are advised to revoke and reissue their certificates along with new private keys as a safety measure 1.
评论
还没有评论，欢迎留下第一条。