# Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers · pwn.watch > Browser-infrastructure provider Kernel (kernel.sh) disclosed on Nov 4 2026 that an attacker used a compromised Kernel API key from Oct 24, then on Oct 27 used it to reach a staff login at Kernel's logging provider and downloaded data that included a small number of Kernel API keys and app deployments' third-party secrets. On Nov 3 the same party used a compromised hosting-provider credential to access four GPU servers, three of which ran Kernel browser sessions, and tried to start cryptominers. Kernel says 0.28% of customers were affected, revoked and rotated the credentials, took the servers offline, and notified affected organizations. It believes the financially motivated actor was using the AI-assisted pentesting platform ARTEX. Kernel customers should follow any notice they got, rotate Kernel API keys and the third-party secrets used in their deployments, and prefer scoped keys. Page: https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 · generated 2026-11-04T23:11:58.039Z ## Status - Severity: medium · status: live · patch: partial - Product: Kernel (kernel.sh) hosted browser infrastructure - Started: 2026-10-24 - Affected: Kernel customers notified as affected (0.28%), whose API keys or deployment third-party secrets were in the logging data or whose browser sessions ran on the accessed servers - Fixed in: Credentials revoked and rotated and servers taken offline Nov 2 to 4 2026; affected customers should rotate their own keys and secrets ## Follow this incident - RSS (one item per update): https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026.json - This file: https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: Kernel publishes a public notice of the incident. (https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026) - 2026-11-03: Same actor uses a compromised hosting-provider credential to access four GPU servers and start cryptominers; Kernel rotates hosting keys, takes the servers offline and notifies affected customers. (https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026) - 2026-11-02: A customer escalation leads Kernel to declare an incident and revoke the leaked API key. (https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026) - 2026-10-27: Attacker uses the key to reach a staff login at Kernel's logging provider and downloads data containing some API keys and deployment secrets. (https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026) - 2026-10-24: Attacker uses a leaked Kernel API key to probe for access and read data across internal profiles. (https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026) ## Fix brief # Security brief: Kernel (kernel.sh) breach: leaked API key led to logging data theft and cryptominers on browser servers Source: https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026 · status: live · severity: medium · updated Nov 4, 2026, 21:17 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Browser-infrastructure provider Kernel (kernel.sh) disclosed on Nov 4 2026 that an attacker used a compromised Kernel API key from Oct 24, then on Oct 27 used it to reach a staff login at Kernel's logging provider and downloaded data that included a small number of Kernel API keys and app deployments' third-party secrets. On Nov 3 the same party used a compromised hosting-provider credential to access four GPU servers, three of which ran Kernel browser sessions, and tried to start cryptominers. Kernel says 0.28% of customers were affected, revoked and rotated the credentials, took the servers offline, and notified affected organizations. It believes the financially motivated actor was using the AI-assisted pentesting platform ARTEX. Kernel customers should follow any notice they got, rotate Kernel API keys and the third-party secrets used in their deployments, and prefer scoped keys. Severity detail: 0.28% of customers affected; some API keys and deployment secrets downloaded from the logging provider; browser-session servers accessed - Product: Kernel (kernel.sh) hosted browser infrastructure ## Affected versions - Kernel customers notified as affected (0.28%), whose API keys or deployment third-party secrets were in the logging data or whose browser sessions ran on the accessed servers ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Credentials revoked and rotated and servers taken offline Nov 2 to 4 2026; affected customers should rotate their own keys and secrets After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes ARTEX also appears in the WorkOS internal sales app breach (workos-internal-sales-app-breach-artex-oct-2026); likely the same late-October AI-assisted campaign. Close once quiet. ## Latest updates - Nov 4, 2026: Kernel publishes a public notice of the incident. - Nov 3, 2026: Same actor uses a compromised hosting-provider credential to access four GPU servers and start cryptominers; Kernel rotates hosting keys, takes the servers offline and notifies affected customers. - Nov 2, 2026: A customer escalation leads Kernel to declare an incident and revoke the leaked API key. - Oct 27, 2026: Attacker uses the key to reach a staff login at Kernel's logging provider and downloads data containing some API keys and deployment secrets. - Oct 24, 2026: Attacker uses a leaked Kernel API key to probe for access and read data across internal profiles. ## Advisories - [November 4, 2026 Public Notice of Security Incident](https://www.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026) (Kernel) ## Write-ups & news - [Kernel.sh Hacked (discussion)](https://news.ycombinator.com/item?id=50371427) --- Machine-readable: https://pwn.watch/i/kernel-sh-browser-infra-breach-cryptominer-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.