Kernel.sh Hacked

Kernel disclosed a security incident involving an attacker who first used a compromised API key on October 24 to probe internal profiles, then used it on October 27 to access the company’s logging provider. The attacker downloaded provider data that included a small number of Kernel API keys and third-party secrets belonging to app deployments. On November 3, the same actor used a compromised hosting-provider credential to access four GPU-enabled servers: three ran Kernel browser sessions, while one held no customer data. The intrusions affected 0.28% of Kernel’s customers. The attacker attempted to install cryptomining software on the servers, consistent with a financially motivated campaign; Kernel says the activity may have been coordinated through the AI-assisted pentesting platform ARTEX.

Kernel’s response began after a customer escalation on November 2. It revoked compromised credentials, removed the attacker’s logging-provider access, blocked associated IP addresses, took affected servers offline, rotated credentials available to those servers, and audited systems for unauthorized access. The company preserved one server for forensic analysis and notified affected organizations with remediation guidance. Its timeline shows that a second critical incident was declared after the November 3 server intrusions, and that containment concluded that night. Kernel plans to expand scoped API-key use, improve controls over where keys can be used and how they are rotated, and strengthen security monitoring and threat-based blocking. It is also sharing confirmed threat intelligence with vendors and abuse-response teams.