{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers · updates",
  "home_page_url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026",
  "feed_url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026/feed.json",
  "description": "Browser-infrastructure provider Kernel (kernel.sh) disclosed on Nov 4 2026 that an attacker used a compromised Kernel API key from Oct 24, then on Oct 27 used it to reach a staff login at Kernel's logging provider and downloaded data that included a small number of Kernel API keys and app deployments' third-party secrets. On Nov 3 the same party used a compromised hosting-provider credential to access four GPU servers, three of which ran Kernel browser sessions, and tried to start cryptominers. Kernel says 0.28% of customers were affected, revoked and rotated the credentials, took the servers offline, and notified affected organizations. It believes the financially motivated actor was using the AI-assisted pentesting platform ARTEX. Kernel customers should follow any notice they got, rotate Kernel API keys and the third-party secrets used in their deployments, and prefer scoped keys.",
  "language": "en",
  "_pwn": {
    "slug": "kernel-sh-browser-infra-breach-cryptominer-nov-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-04-1dbc0d29",
      "url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-04-1dbc0d29",
      "title": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Kernel publishes a public notice of the incident.",
      "content_text": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Kernel publishes a public notice of the incident.\n\nSource: https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-03-ab016e07",
      "url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-03-ab016e07",
      "title": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Same actor uses a compromised hosting-provider credential to access four GPU servers and start cryptominers; Kernel rotates hosting keys, takes the servers offline and notifies affected customers.",
      "content_text": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Same actor uses a compromised hosting-provider credential to access four GPU servers and start cryptominers; Kernel rotates hosting keys, takes the servers offline and notifies affected customers.\n\nSource: https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-02-ee655d00",
      "url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-02-ee655d00",
      "title": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: A customer escalation leads Kernel to declare an incident and revoke the leaked API key.",
      "content_text": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: A customer escalation leads Kernel to declare an incident and revoke the leaked API key.\n\nSource: https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "date_published": "2026-11-02T00:00:00.000Z",
      "external_url": "https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-10-27-8cd8d9f3",
      "url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-10-27-8cd8d9f3",
      "title": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Attacker uses the key to reach a staff login at Kernel's logging provider and downloads data containing some API keys and deployment secrets.",
      "content_text": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Attacker uses the key to reach a staff login at Kernel's logging provider and downloads data containing some API keys and deployment secrets.\n\nSource: https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-10-24-3ab36fb5",
      "url": "https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-10-24-3ab36fb5",
      "title": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Attacker uses a leaked Kernel API key to probe for access and read data across internal profiles.",
      "content_text": "Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Attacker uses a leaked Kernel API key to probe for access and read data across internal profiles.\n\nSource: https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "date_published": "2026-10-24T00:00:00.000Z",
      "external_url": "https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
      "tags": [
        "medium"
      ]
    }
  ]
}