Tools AI Risk Radar ai-incident-0171
Incident record
PoeLLM malware targets exposed AI services
- Severity
- High
- Status
- In the wild
- Type
- Infra Vuln
- Target
- Exposed LiteLLM, Ollama and other internet services
- Actor
- unknown
What happened
Lumen reports an active campaign that compromises exposed services to run cryptocurrency miners and scan for further victims. Its investigation traces activity back to April 2026.
The researchers identify CVE-2026-42271 as a likely entry route for some LiteLLM systems. The initial access method varies across the campaign. The report describes malware targeting AI infrastructure.
Sources
- Primary disclosurewww.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026