Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers ยท updates https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 Browser-infrastructure provider Kernel (kernel.sh) disclosed on Nov 4 2026 that an attacker used a compromised Kernel API key from Oct 24, then on Oct 27 used it to reach a staff login at Kernel's logging provider and downloaded data that included a small number of Kernel API keys and app deployments' third-party secrets. On Nov 3 the same party used a compromised hosting-provider credential to access four GPU servers, three of which ran Kernel browser sessions, and tried to start cryptominers. Kernel says 0.28% of customers were affected, revoked and rotated the credentials, took the servers offline, and notified affected organizations. It believes the financially motivated actor was using the AI-assisted pentesting platform ARTEX. Kernel customers should follow any notice they got, rotate Kernel API keys and the third-party secrets used in their deployments, and prefer scoped keys. en Wed, 04 Nov 2026 00:00:00 GMT Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Kernel publishes a public notice of the incident. https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-04-1dbc0d29 Wed, 04 Nov 2026 00:00:00 GMT medium <p><a href="https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026">Source</a></p> Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Same actor uses a compromised hosting-provider credential to access four GPU servers and start cryptominers; Kernel rotates hosting keys, takes the servers offline and notifies affected customers. https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-03-ab016e07 Tue, 03 Nov 2026 00:00:00 GMT medium <p><a href="https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026">Source</a></p> Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: A customer escalation leads Kernel to declare an incident and revoke the leaked API key. https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-11-02-ee655d00 Mon, 02 Nov 2026 00:00:00 GMT medium <p><a href="https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026">Source</a></p> Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Attacker uses the key to reach a staff login at Kernel's logging provider and downloads data containing some API keys and deployment secrets. https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-10-27-8cd8d9f3 Tue, 27 Oct 2026 00:00:00 GMT medium <p><a href="https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026">Source</a></p> Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers: Attacker uses a leaked Kernel API key to probe for access and read data across internal profiles. https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026#2026-10-24-3ab36fb5 Sat, 24 Oct 2026 00:00:00 GMT medium <p><a href="https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026">Source</a></p>