PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
PoeLLM has compromised over 3,400 servers, mining cryptocurrency and spreading through exposed AI and web apps.
78
Product
Ivanti Sentry
- Mentions · 7d0
- Mentions · 30d5
- All mentions10
- First seenSep 8, 2026
- Last mentioned23d ago
Timeline
10 articles · newest firstPoetry is the new AI security threat as PoeLLM malware infects 3K+ servers
PoeLLM malware has infected over 3,000 servers since April, hiding command-and-control in a GitHub poem while mining cryptocurrency.
80
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
PoeLLM malware has infected over 3,400 servers to build a cryptomining botnet called Canto Incognito.
74
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
76
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers, encoding its command-and-control address in a GitHub poem.
77
Ivanti Patches Critical Flaws Across Enterprise Security Products
Ivanti released September updates fixing six critical RCE flaws in Neurons for ITSM plus authentication bypasses in Sentry and EPMM; no exploitation seen.
62
Ivanti Patches 10 EPMM, Neurons for ITSM and Sentry Flaws Enabling RCE and Admin Access
Ivanti patches 10 flaws in EPMM, Neurons for ITSM, and Sentry, including two 9.8-rated unauthenticated RCEs in ITSM.
60
Ivanti security advisory (AV26-897)
Canada's Cyber Centre relayed Ivanti's September 2026 security updates for Endpoint Manager Mobile, Neurons for ITSM, and Sentry, urging administrators to patch.
32
Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks
Ivanti patched ten CVEs across EPMM, Neurons for ITSM and Sentry, including critical unauthenticated deserialization RCE; no active exploitation reported.
68
2026-008: Critical vulnerabilities in Ivanti Sentry
Ivanti patched Sentry: pre-auth OS command injection CVE-2026-10520 (CVSS 10) enables unauthenticated root RCE, and auth bypass CVE-2026-10523 (CVSS 9.9).
70
Related CVEs
by mentions- CVE-2026-188511%8.8Missing Authorization in Ivanti Endpoint Manager Mobile Allows Admin Privilege Escalation
- CVE-2026-835271%8.1Authentication Bypass in Ivanti Sentry Grants Remote Admin Access
- CVE-2026-127452%9.8Unauthenticated RCE via Deserialization in Ivanti Neurons for ITSM
- CVE-2026-127442%9.8Unauthenticated Deserialization RCE in Ivanti Neurons for ITSM
- CVE-2026-126511%8.8Authenticated Deserialization RCE in Ivanti Neurons for ITSM
- CVE-2026-126481%8.8Authenticated Deserialization RCE in Ivanti Neurons for ITSM
- CVE-2026-126451%8.8Missing Authorization Flaw Enables Authenticated RCE in Ivanti Neurons for ITSM
- CVE-2026-126461%8.8Missing Authorization Enables Authenticated RCE in Ivanti Neurons for ITSM
- CVE-2026-126471%8.8Authenticated RCE via Missing Authorization in Ivanti Neurons for ITSM
- CVE-2026-126501%8.8Authenticated Deserialization RCE in Ivanti Neurons for ITSM
Appears with
- Ivantivendor · 10
- PoeLLMmalware · 5
- Gotenbergproduct · 5
- LiteLLMproduct · 5
- Giteaproduct · 5
- Ollamaproduct · 4
- XMRigmalware · 4
- Ivanti Neurons for ITSMproduct · 4
- Black Lotus Labsorganization · 4
- Ivanti Endpoint Manager Mobileproduct · 3
- Kryptexorganization · 3
- Lumenorganization · 3
- Ironmalware · 3
- Lumen Technologiesorganization · 2
- Aquila Sec Laborganization · 1
- Citrixvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.