Security48 mOctober 9, 2026, 02:58

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

Lumen's Black Lotus Labs uncovered the PoeLLM botnet, which mines cryptocurrency on servers running LiteLLM, Ollama, Gotenberg and Gitea. Command-and-control addresses are encoded in a GitHub poem, and initial access came through LiteLLM vulnerability CVE-2026-42271.

DEV Community

Open source

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

Affected deployments run LiteLLM, Ollama, Gotenberg and Gitea
CVE-2026-42271 is fixed in LiteLLM 1.83.7
C&C addresses are encoded in words of a GitHub poem
Activity traced back to April 2026

#LiteLLM#Ollama#GitHub

PoeLLM malware infects 2,100 AI servers in cryptomining attacks

Security

Attackers use GitHub poem to infect thousands of servers with malware

Security

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

PoeLLM malware infects 2,100 AI servers in cryptomining attacks

Attackers use GitHub poem to infect thousands of servers with malware

NIO ES8 in Norwegian Mine: 90% of Traffic Went to Chinese Servers

669 open-source AI agent repos ranked by activity, not stars