Brief · Builders
Your exposed AI server is mining crypto for a guy with a poem
Lumen's Black Lotus Labs says a botnet it calls PoeLLM has hit more than 3,400 servers since April 2026, mostly vulnerable internet-facing LiteLLM and Ollama, plus hundreds running Gotenberg and Gitea. Infected boxes mine crypto and scan for the next victim. It finds its command server by reading a poem in a GitHub repo, and the operator has changed the poem 11 times to move it.
The poem is cute. The way in isn't. The likely LiteLLM path is the /mcp-rest/test/connection endpoint referenced in CVE-2026-42271, a command injection bug. Lumen didn't name a flaw for the Ollama, Gotenberg and Gitea victims, and Gotenberg's own install docs warn you not to expose it to the internet.
Do these people know you can just stop doing things? Like putting model servers on public ports.
What to do: Take LiteLLM (port 4000), Gotenberg (3000), Ollama (11434) and Gitea off the open internet, upgrade LiteLLM to 1.83.7 or later, and check your logs against Lumen's IOCs.