A Poem on GitHub and a CVE Chain: the PoeLLM Botnet Mining on Exposed AI Infrastructure

Summary PoeLLM is malware that Black Lotus Labs (Lumen) has tracked since April 2026. It has compromised more than 3,400 servers, peaking at over 800 active systems per day. Victims are concentrated i