Kernel discloses logging-provider data theft and access to three browser-session servers
Kernel says stolen credentials enabled logging-provider data downloads and access to four GPU servers, three running customer browser sessions. Logs contained some Kernel API keys and deployment secrets. The vendor reports 0.28% of customers affected, revoked credentials and isolated servers; it suspects ARTEX-assisted cryptomining.
- Disclosed
- Nov 4, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Notified Kernel customers with exposed logging data, deployment secrets or sessions on the three affected browser servers.
- Kernel · Credentials · Cloud
- In the wild
- Yes
- Kernel confirms data downloads and server access; ARTEX involvement is its assessment.
What happened
Kernel’s November 4 notice describes two connected intrusions. A compromised Kernel API key first enabled internal-profile access, then access to a staff login at its logging provider. Downloaded logging data contained some Kernel API keys and third-party secrets from app deployments. Later, a compromised hosting-provider credential enabled access to four GPU servers, three of which ran customer browser sessions. The fourth was a development server with no customer data. The notice does not explain how the first key was obtained or establish that every browser session or stored credential was copied.
Kernel says it revoked compromised credentials, removed logging-provider access, blocked the involved IP addresses, took the servers offline, rotated credentials accessible to them and notified affected organizations. It reports an impact of 0.28% of customers, without an absolute count. Customer-managed third-party credentials and session access still need organization-specific review; vendor containment is not proof that downstream credentials were never misused.
The company assesses a financially motivated cryptomining campaign and believes ARTEX was used to coordinate it. That is attributed vendor analysis, not independent actor attribution or proof that this is the same intrusion as the separate WorkOS incident. L3 reflects confirmed credential exposure and infrastructure access in a browser service, with a limited reported customer proportion and unresolved detailed scope. No customer software fix or universal safe version is published.
Crime-scene timeline
Oct 24, 21:18 UTC
Compromised API key used to read internal-profile data
The vendor's retrospective dates the first probing and access to October 24; this is not the public disclosure date.
Oct 27, 18:01 UTC
Attacker reaches the logging provider
Kernel reports access through a staff login and downloaded data containing a small number of Kernel API keys and app deployments' third-party secrets.
Nov 2, 19:28 UTC
Affected customer escalates the issue
Nov 2, 22:20 UTC
Kernel declares its first incident
It revokes the identified API key at 22:30 UTC and escalates severity at 23:50 UTC. The first containment phase ends November 3 at 02:00 UTC.
Nov 3, 05:41–07:17:57 UTC
Compromised hosting credential reaches four GPU servers
A miner starts on a development server with no customer data; the same miner is attempted on other servers. Three affected servers ran Kernel browser sessions. Server access is not proof every session secret was stolen.
Nov 3, 07:37 UTC
Hosting-provider API keys rotated
Browser servers are taken offline at 07:46 UTC; the development server follows at 09:29 UTC, with a forensic clone retained. Kernel links the two incidents to the same actor at 09:00 UTC.
Nov 3, 22:50 UTC
Second containment phase ends and affected customers are notified
Kernel reports rotating all credentials accessible to the affected servers, auditing potential unauthorized access and sending remediation guidance.
Nov 4, 2026
Kernel publishes its incident notice
The vendor reports 0.28% of customers affected and assesses a financially motivated cryptomining campaign using ARTEX. It plans stronger API-key scoping, network controls, rotation and monitoring.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Kernel original November 4 incident noticePrimaryConfirms compromised API/hosting credentials, logging downloads, four GPU servers, 0.28% customer impact and UTC response chronology. ARTEX and financial motivation are vendor assessments; no absolute victim count or public indicator list.