Security researchers at Lumen have documented PoeLLM, a Linux malware that exploits internet-exposed instances of LiteLLM, Ollama, Gotenberg, and Gitea to deploy the XMRig and Iron cryptocurrency mine…
CISA added CVE-2026-49869, a CVSS 10.0 authentication bypass in Kestra OSS, to its Known Exploited Vulnerabilities catalog on September 2, 2026, after real-world attacks deploying crypto miners and ha…
Microsoft Security Research has documented attacks targeting AI infrastructure components, including LiteLLM, RAGFlow, and Kestra, which were compromised and abused for credential theft, persistence, …
Darktrace reported on July 9, 2026, that an EC2 LiteLLM-Proxy AI gateway with Amazon Bedrock access was compromised and used for cryptomining, though the initial access path remains unconfirmed. The i…
Attackers compromised an AWS EC2 instance acting as a LiteLLM proxy for Amazon Bedrock, deploying XMRig cryptomining malware and attempting to abuse cloud identities and AI services. Cybersecurity fir…