Ivanti Sentry

PoeLLM: a cryptomining botnet that reads its C2 address out of a GitHub poem compromises exposed LiteLLM, Ollama, Gotenberg and Gitea servers and turns them into scanners

Lumen's Black Lotus Labs says PoeLLM has been active since at least April 2026, deploys XMRig and Iron cryptocurrency miners that connect to a Kryptex mining pool, and is deployed through vulnerability exploitation of publicly exposed services, mainly LiteLLM and Ollama and, in the hundreds, the Gotenberg PDF converter and Gitea, with other products such as Ivanti Sentry possibly targeted (Lumen, 2026-10-07). It counts more than 3,400 impacted servers, a figure it raised after first circulating the report (BleepingComputer, 2026-10-07), predominantly in the United States and Western Europe, and assesses that PoeLLM is associated with an Italian-speaking threat actor (Lumen, 2026-10-07).

The command channel is the unusual part: the malware derives its current C2 server from keywords in a poem hosted in a GitHub repository, so the operator rotates servers by editing the poem, which Lumen counts 11 edits of since the first commit on 2026-04-13 (Lumen, 2026-10-07). Several C2 servers were routers with exposed administration pages, which Lumen reads as the operator repurposing compromised routers (Lumen, 2026-10-07). Infected servers become scanners and exploit launchers that sweep ports 3000 and 4000, the primary ports of Gotenberg and LiteLLM, and send a crafted POST that makes the target fetch a payload from the C2; the payload is a single ELF binary that bundles a remote shell, the miners, HTTP and HTTPS scanning and exploit deployment, and beacons back to the C2 (Lumen, 2026-10-07). For LiteLLM, Lumen says the endpoint /mcp-rest/test/connection, which the CVE-2026-42271 command injection references, was likely the exploitation path (Lumen, 2026-10-07), and BleepingComputer adds that Horizon3 showed it can be chained with CVE-2026-48710 for unauthenticated remote code execution (BleepingComputer, 2026-10-07). Lumen met the infrastructure while investigating the Ivanti Sentry flaw CVE-2026-10520, when a compromised Sentry victim contacted a PoeLLM C2 and began scanning for other vulnerable devices; it states no further link between that flaw and the botnet (Lumen, 2026-10-07).

Builds on: CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV · CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass… · Three unrelated AI platforms, three intrusions, one pattern: gateways and orchestrators… · CVE-2026-10520 / CVE-2026-10523, Ivanti Sentry: pre-auth OS command injection to root (CVSS…

Ivanti September 2026 Security Update, ten CVEs across Neurons for ITSM, Sentry and EPMM, two unauthenticated CVSS 9.8 deserialization RCEs

Ivanti's 2026-09-08 security update discloses ten CVEs across three product lines, none reported exploited (Ivanti, 2026-09-08). Neurons for ITSM carries the most severe pair: CVE-2026-12744 and CVE-2026-12745, both CVSS 9.8 unauthenticated deserialization-of-untrusted-data flaws reaching remote code execution on the server with no credentials and no user interaction (SecurityWeek, 2026-09-09). Six further ITSM flaws need low-privilege authentication first: three missing-authorization bugs (CVE-2026-12645/12646/12647, CVSS 9.9) and three further deserialization paths (CVE-2026-12650 at 9.9, CVE-2026-12651/12648 at 8.8) all escalate an authenticated low-privilege session to code execution or full administrative control (SecurityWeek, 2026-09-09; Cyber Security News, 2026-09-08). Ivanti Sentry carries CVE-2026-83527 (CVSS 8.1), a high-attack-complexity authentication bypass that lets a remote unauthenticated attacker obtain administrative access to the Sentry platform (NCSC-NL NCSC-2026-0357, 2026-09-09). Ivanti Endpoint Manager Mobile carries CVE-2026-18851 (CVSS 8.8), a missing-authorization flaw letting an authenticated low-privilege user escalate to full administrator (NCSC-NL NCSC-2026-0359, 2026-09-09).

The September patch covers on-premises Neurons for ITSM versions 2025.2, 2025.3, 2025.4 and 2026.1; the fixes are also included in the 2026.2 release line, scheduled for 2026-09-21 (SecurityWeek, 2026-09-09). NCSC-NL's advisory additionally lists the Cloud/SaaS edition of Neurons for ITSM as affected, without stating a separate cloud remediation date (NCSC-NL NCSC-2026-0358, 2026-09-09). Sentry is fixed in R10.8.2/R10.7.3/R10.6.4, EPMM in 12.10.0.0/12.9.0.2/12.8.0.4 (SecurityWeek, 2026-09-09). Ivanti states it has no evidence of exploitation for any of the ten and that no other Ivanti product is affected (Ivanti, 2026-09-08). Notably, Ivanti states it has integrated multiple advanced large language models into its product-security and engineering workflows to identify vulnerabilities "especially those that are difficult to identify with traditional tooling, such as SAST and DAST," and credits this with surfacing some of the flaws disclosed today (Ivanti, 2026-09-08); a rare instance of AI-assisted vulnerability discovery being credited directly in a formal vendor advisory (Cyber Security News, 2026-09-08).