Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.
65
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenSep 12, 2026
- Last mentioned22d ago
Timeline
3 articles · newest firstWhat Would a Serious AI Product Look Like?
A developer argues AI products lack first-class tools for checking mistakes and presenting real citations.
28
[AINews] DeepSeek v4.1-Flash: 763B-P8B-D16B novel causal Encoder–Decoder architecture with vision marks the Return of the Whale
DeepSeek released V4.1-Flash, an open-weight 763B-parameter model with a novel causal encoder-decoder architecture, 1M context, vision input, and MIT license.
80
Related CVEs
by mentions- CVE-2026-10520100%10.0Unauthenticated OS Command Injection in Ivanti Sentry
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
Appears with
- Ollamavendor · 2
- PoeLLMorganization · 1
- DeepSeek V4.1-Flashproduct · 1
- Valsorganization · 1
- ChatGPTproduct · 1
- DeepSeek V4.1-Flashai model · 1
- Anthropicorganization · 1
- Googleorganization · 1
- Anthropicvendor · 1
- Basetenorganization · 1
- DeepSeekvendor · 1
- Gotenbergorganization · 1
- Black Lotus Labsorganization · 1
- DeepSeekorganization · 1
- Geminiproduct · 1
- Claudeproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.