Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Breaches & attacks
LiveMediumPartly patchedBreaches & attacks

Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers

Kernel (kernel.sh) hosted browser infrastructure

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Browser-infrastructure provider Kernel (kernel.sh) disclosed on Nov 4 2026 that an attacker used a compromised Kernel API key from Oct 24, then on Oct 27 used it to reach a staff login at Kernel's logging provider and downloaded data that included a small number of Kernel API keys and app deployments' third-party secrets. On Nov 3 the same party used a compromised hosting-provider credential to access four GPU servers, three of which ran Kernel browser sessions, and tried to start cryptominers. Kernel says 0.28% of customers were affected, revoked and rotated the credentials, took the servers offline, and notified affected organizations. It believes the financially motivated actor was using the AI-assisted pentesting platform ARTEX. Kernel customers should follow any notice they got, rotate Kernel API keys and the third-party secrets used in their deployments, and prefer scoped keys.

Why this severity: 0.28% of customers affected; some API keys and deployment secrets downloaded from the logging provider; browser-session servers accessed

Started
Oct 24, 2026

Follow this incident

Discuss on X ↗

Affected

  • Kernel customers notified as affected (0.28%), whose API keys or deployment third-party secrets were in the logging data or whose browser sessions ran on the accessed servers

Fixed in

  • Credentials revoked and rotated and servers taken offline Nov 2 to 4 2026; affected customers should rotate their own keys and secrets

Timeline5

  1. Kernel publishes a public notice of the incident.

  2. Same actor uses a compromised hosting-provider credential to access four GPU servers and start cryptominers; Kernel rotates hosting keys, takes the servers offline and notifies affected customers.

  3. A customer escalation leads Kernel to declare an incident and revoke the leaked API key.

  4. Attacker uses the key to reach a staff login at Kernel's logging provider and downloads data containing some API keys and deployment secrets.

  5. Attacker uses a leaked Kernel API key to probe for access and read data across internal profiles.

Advisories1

News & write-ups1

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo