Story · 7 sources · 7 articlesfirst Oct 7, 15:00 UTCupdated Oct 8, 10:24 UTC (13h ago)

PoeLLM 'Canto Incognito' botnet infects 3,400+ servers, decoding C2 addresses from a GitHub-hosted poem

highMalwareexploited in the wildimportance 80CVE-2026-10520 CVE-2026-42271 CVE-2026-48710

What's new: The only new report since the previous summary is Help Net Security (2026-10-08T10:24). It confirms the 3,400+ server count, the April 2026 start, LiteLLM CVE-2026-42271, and Ivanti Sentry CVE-2026-10520, and adds new details: the GitHub poem has been edited 11 times to rotate C2 servers (consistent with BleepingComputer's report of at least 11 controllers), bots scan for new victims on ports…

Merged summary · glm-5.3 · rewritten as coverage arrives

Lumen's Black Lotus Labs says PoeLLM malware has compromised more than 3,400 exposed servers since April 2026, deriving command-and-control IPv4 addresses from words in a GitHub poem while running XMRig and Iron cryptominers.

Lumen Technologies' Black Lotus Labs reports that PoeLLM, a Linux malware tracked as the 'Canto Incognito' campaign, has compromised more than 3,400 servers since at least April 2026, mainly in the United States and Western Europe; The Register puts the figure above 3,000 and BleepingComputer above 2,100, with peak activity of roughly 800 infections in a single day. The malware exploits exposed open-source services including LiteLLM, Ollama, Gotenberg, and Gitea; BleepingComputer, The Hacker News, Help Net Security, and The Register also implicate Ivanti Sentry, while GBHackers says only possibly. Its command-and-control IPv4 address is assembled from four words in a poem hosted on GitHub, mapped through a hard-coded dictionary, letting operators rotate infrastructure by editing the poem — done 11 times per Help Net Security, matching BleepingComputer's report of at least 11 controllers. Compromised hosts scan for new victims (on ports 3000 and 4000 per Help Net Security), deploy exploits, open remote shells, run XMRig and Iron miners tied to the Russian Kryptex service, and have begun experimenting with distributed SSH brute-force attacks; CyberScoop adds that the remote code execution capability could be used to abuse AI models on victim servers. Vulnerabilities cited include LiteLLM CVE-2026-42271 — described variously as command injection (Cyber Security News, Help Net Security), authenticated command execution fixed in LiteLLM 1.83.7 (GBHackers), or chainable with CVE-2026-48710 for unauthenticated RCE (BleepingComputer) — plus Ivanti Sentry flaw CVE-2026-10520, which The Register says surfaced the activity during a separate investigation. Attribution is to an Italian-speaking, financially motivated operator with moderate confidence, based on Italian-language code comments and Italy-based servers, with no observed links to known groups; GBHackers reports Lumen blocked traffic to identified command servers.

Lumen's Black Lotus Labs tracks the campaign as 'Canto Incognito'; PoeLLM has been active since at least April 2026, mainly affecting the US and Western Europe.
Five of seven outlets (CyberScoop, The Hacker News, GBHackers, Cyber Security News, Help Net Security) report more than 3,400 compromised servers; The Register says more than 3,000 and BleepingComputer says more than 2,100.
Peak activity reached roughly 800 infections in a single day — 'as many as 800 active in one day' per BleepingComputer and 'above 800 daily' per GBHackers.

VendorsIvanti GitHub

ProductsLiteLLM Ollama Gotenberg Gitea Ivanti Sentry

Threat actorsCanto Incognito

MalwarePoeLLM XMRig Iron

OrganizationsBlack Lotus Labs Lumen GitHub Kryptex Lumen Technologies Horizon.ai Lumen Black Lotus Labs PoeLLM LiteLLM Ollama Gotenberg

Coverage timelineoldest first · each row is one article

Oct 7, 15:00 UTC · 1d ago
CyberScoop· 77
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers, encoding its command-and-control address in a GitHub poem.
Oct 7, 15:04 UTC · 1d ago
BleepingComputer· 76
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
Oct 7, 15:33 UTC · 1d ago
The Hacker News· 74
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

Vulnerabilities in this storyAll →

CVE-2026-1052010.0100%
Unauthenticated OS Command Injection in Ivanti Sentry
published Jun 9, 2026· Ivanti Sentry (formerly MobileIron Sentry) KEV PoC
CVE-2026-42271

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-10520	Unauthenticated OS Command Injection in Ivanti Sentry Ivanti Sentry (formerly MobileIron Sentry) contains an OS command injection flaw (CWE-78) that lets a remote, unauthenticated attacker execute operating-system commands with root privileges on the appliance. Exploitation succeeds when the Sentry appliance is in an unmanaged state with its endpoints externally reachable; deployments that enforce mTLS with EPMM or restrict HTTPS access through Ivanti Neurons for MDM keep the interfaces inaccessible to external actors. A successful attacker gains root-level remote code execution, giving full control of the gateway that fronts an organization's mobile device management (MDM) infrastructure. Organizations running unmanaged, internet-exposed Ivanti/MobileIron Sentry appliances are affected. The flaw is being exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-11 (formal CVSS scoring is still pending), EPSS puts the 30-day exploitation probability at 99.9%, no public proof-of-concept is known, and ransomware use is undetermined. Do: Inventory all Ivanti/MobileIron Sentry appliances and determine whether they are unmanaged with externally reachable endpoints; apply Ivanti's mitigations in line with CISA KEV and BOD 26-04 timelines, and where a patch is not yet in place, restrict access by enabling mTLS with EPMM or limiting HTTPS access through Ivanti Neurons for MDM. Monitor Ivanti's advisories for fixed versions and review exposed appliances for signs of compromise.	10.0	100%	KEV PoC	Ivanti Sentry (formerly MobileIron Sentry)	nichelow thousands of internet-exposed Sentry appliances (estimate; only unmanaged, externally reachable deployments are exploitable)	Jun 9, 2026 KEV Jun 11, 2026
CVE-2026-42271	Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild CVE-2026-42271 is a command injection (CWE-77/CWE-78) in BerriAI LiteLLM's proxy server, a widely used AI gateway for calling LLM APIs. Two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) accept a full stdio server configuration, including command, args, and env fields, and spawn the supplied command as a subprocess on the proxy host; the endpoints are gated only by any valid proxy API key with no role check, so even low-privilege internal-user keys can trigger it. An attacker with any authenticated key gains arbitrary command execution with the privileges of the proxy process, and reporting indicates attackers are chaining the flaw into broader takeover of AI gateway servers, including reverse shells and crypto miners, in some cases via weak or default keys such as the example 'sk-1234' admin key. Any organization running LiteLLM versions 1.74.2 through before 1.83.7, including LiteLLM distributed with Red Hat OpenShift AI, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 and is under active attack, with a very high EPSS of 83.6% for exploitation within 30 days. Do: Upgrade LiteLLM to version 1.83.7 or later immediately (federal agencies must act per CISA KEV/BOD 22-01), and apply Red Hat's advisory updates if running OpenShift AI. Until patched, restrict or rotate proxy API keys — especially low-privilege internal-user and any default/example keys such as 'sk-1234' — and limit network access to the /mcp-rest/test/* endpoints. Review proxy hosts for indicators of compromise such as unexpected spawned subprocesses, reverse shells, or crypto miners, and rotate credentials that may have been captured via compromised environments.	8.7	93%	KEV
CVE-2026-48710	HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710) Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days. Do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions.	6.5	7%	KEV

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-10520

Unauthenticated OS Command Injection in Ivanti Sentry

Ivanti Sentry (formerly MobileIron Sentry) contains an OS command injection flaw (CWE-78) that lets a remote, unauthenticated attacker execute operating-system commands with root privileges on the appliance. Exploitation succeeds when the Sentry appliance is in an unmanaged state with its endpoints externally reachable; deployments that enforce mTLS with EPMM or restrict HTTPS access through Ivanti Neurons for MDM keep the interfaces inaccessible to external actors. A successful attacker gains root-level remote code execution, giving full control of the gateway that fronts an organization's mobile device management (MDM) infrastructure. Organizations running unmanaged, internet-exposed Ivanti/MobileIron Sentry appliances are affected. The flaw is being exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-11 (formal CVSS scoring is still pending), EPSS puts the 30-day exploitation probability at 99.9%, no public proof-of-concept is known, and ransomware use is undetermined.

Do: Inventory all Ivanti/MobileIron Sentry appliances and determine whether they are unmanaged with externally reachable endpoints; apply Ivanti's mitigations in line with CISA KEV and BOD 26-04 timelines, and where a patch is not yet in place, restrict access by enabling mTLS with EPMM or limiting HTTPS access through Ivanti Neurons for MDM. Monitor Ivanti's advisories for fixed versions and review exposed appliances for signs of compromise.

10.0

100%

KEV PoC

Ivanti Sentry (formerly MobileIron Sentry)

nichelow thousands of internet-exposed Sentry appliances (estimate; only unmanaged, externally reachable deployments are exploitable)

Jun 9, 2026

KEV Jun 11, 2026

CVE-2026-42271

Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild

CVE-2026-42271 is a command injection (CWE-77/CWE-78) in BerriAI LiteLLM's proxy server, a widely used AI gateway for calling LLM APIs. Two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) accept a full stdio server configuration, including command, args, and env fields, and spawn the supplied command as a subprocess on the proxy host; the endpoints are gated only by any valid proxy API key with no role check, so even low-privilege internal-user keys can trigger it. An attacker with any authenticated key gains arbitrary command execution with the privileges of the proxy process, and reporting indicates attackers are chaining the flaw into broader takeover of AI gateway servers, including reverse shells and crypto miners, in some cases via weak or default keys such as the example 'sk-1234' admin key. Any organization running LiteLLM versions 1.74.2 through before 1.83.7, including LiteLLM distributed with Red Hat OpenShift AI, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 and is under active attack, with a very high EPSS of 83.6% for exploitation within 30 days.

Do: Upgrade LiteLLM to version 1.83.7 or later immediately (federal agencies must act per CISA KEV/BOD 22-01), and apply Red Hat's advisory updates if running OpenShift AI. Until patched, restrict or rotate proxy API keys — especially low-privilege internal-user and any default/example keys such as 'sk-1234' — and limit network access to the /mcp-rest/test/* endpoints. Review proxy hosts for indicators of compromise such as unexpected spawned subprocesses, reverse shells, or crypto miners, and rotate credentials that may have been captured via compromised environments.

8.7

93%

KEV

CVE-2026-48710

HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)

Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days.

Do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions.

6.5

KEV