Bunny.net disclosed a security incident involving a third-party infrastructure provider that reported unauthorized access to its server-management software. One Bunny.net CDN node in Armenia was hosted on the provider’s equipment. Within 20 minutes of being notified, Bunny.net stopped routing traffic through the node, preserved security logs, wiped the server, and revoked its access to other systems; the server has since been permanently removed. Bunny.net and the provider found no evidence that the node or its data was accessed, though the investigation has not ruled out that possibility.
If access did occur, information potentially exposed on the node included temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored there. Bunny.net says account data and other customer data were not on the server, and no internal systems were affected. As a precaution, it revoked and replaced certificates for its platform domains. Managed certificates for custom domains are being reissued gradually with new private keys, a process now expected to finish by the end of October 31; existing certificates remain in use until replacement, so customers using managed certificates need take no action. Customers who manage their own certificates are advised to revoke and reissue them using new private keys. Bunny.net is monitoring the situation and will provide further updates if investigations uncover findings relevant to customers.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a critical Linux IPv4 TCP handshake use-after-free, remotely exploitable without authentication and potentially allowing root command execution on servers with multipath TCP listeners. Upstream fixes are available, but Ubuntu and RHEL had not yet shipped patched kernels as of October 29, 2026. (atlasum.net)
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
VOLTA infostealer steals credentials, financial data, and personal details, then sends an evidence bundle to an LLM to rank victims by potential value. If a model refuses, the malware tries a chain of other models, making AI a key part of its intelligence-gathering workflow. (blog.talosintelligence.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.