Daily digest,
PoeLLM Malware Compromises 3,400+ AI Servers for Cryptomining (+7 more)
Vulnerabilities
PoeLLM Malware Compromises 3,400+ AI Servers for Cryptomining
PoeLLM malware has targeted exposed AI services since April 2026, compromising over 3,400 servers. The malware uses a unique method to derive command-and-control (C2) server addresses from a poem hosted on GitHub. It has been linked to a cryptomining campaign, deploying miners like XMRig and Iron, and connecting victims to the Kryptex mining service. The attacks primarily affect systems running LiteLLM, Ollama, Gotenberg, and Gitea, with significant activity observed in the U.S. and Western Europe. The malware's functionality allows it to turn compromised servers into scanners and exploit launchpads for further attacks. Notable CVEs associated with the exploited vulnerabilities include CVE-2026-42271 and CVE-2026-48710. The campaign has shown a significant increase in activity, with peak infections reaching 800 active systems in a single day. Researchers attribute the operation to an Italian-speaking threat actor, based on language artifacts found in the malware.
Vulnerability · 4 sources · score 74 · CVE-2026-42271, CVE-2026-48710, Iron, PoeLLM, XMRig
Critical LMCache Flaw Enables Unauthenticated Remote Code Execution
A critical vulnerability (CVE-2026-105192) in LMCache, an open-source caching software for large language models, allows unauthenticated attackers to execute code remotely. The flaw exists in the multiprocess mode, where a ZeroMQ socket is exposed without authentication, enabling exploitation via crafted messages. The vulnerability affects versions 0.3.9 through 0.5.5, with no patch available as of October 7, 2026. JFrog, which disclosed the flaw, assigned it a CVSS score of 9.8, indicating critical severity. Attackers can exploit the flaw if the server is configured to listen on a routable address. The default configuration is safer as it binds to localhost. JFrog advises operators to avoid exposing the multiprocess server to untrusted networks until a fix is released. No has been reported in the wild.
Vulnerability · 4 sources · score 68 · CVE-2026-105192, CVE-2026-105756
Rising Risks in Open-Source Software from Frontier AI Vulnerabilities
Recent reports highlight significant vulnerabilities in open-source software (OSS) exacerbated by frontier AI technologies. Palo Alto Networks Unit 42 identified over 14,000 vulnerabilities across 3,915 OSS projects within two months, with 99.4% classified as zero-days and 40% rated high or critical severity. This rapid discovery of vulnerabilities poses increased risks as AI coding agents can inadvertently introduce malicious packages into codebases. The lack of comprehensive software bills of materials (SBOM) from commercial manufacturers further complicates vulnerability management, with only 32% providing full transparency. Traditional software composition analysis tools often generate excessive findings, causing critical vulnerabilities to be overlooked. The need for continuous visibility and proactive remediation strategies is emphasized to mitigate these risks before they reach production environments.
Vulnerability · 2 sources · score 68
AI Research Identifies 140 Windows CVEs, Fixes Lag Behind
Microsoft's FORGE Lab reported the identification of 140 Windows vulnerabilities assigned CVEs between May and September 2026. Additionally, 155 validated reports were submitted across 23 open-source projects, with one Linux report leading to a patch merged into the kernel. The findings highlight a significant bottleneck: while AI can effectively discover vulnerabilities, the challenge lies in validating and fixing them at scale. The report emphasizes that the speed of remediation must match the pace of discovery to enhance security. Key vulnerabilities include CVE-2026-9545, CVE-2026-13608, CVE-2026-56848, and CVE-2026-64563, all rated as high severity. The articles suggest that organizations need to focus on improving their validation and remediation processes to keep up with the vulnerabilities identified by AI.
Vulnerability · 2 sources · score 58 · CVE-2026-13608, CVE-2026-56848, CVE-2026-64563, CVE-2026-9545, Akrites
Ransomware
FlyDubai Ransomware Attack Exposes Sensitive Data and Boeing Code
The Everest ransomware gang claims to have exfiltrated 4.36GB of data from FlyDubai, including personal records of 2,862 employees and Boeing proprietary source code. The stolen data reportedly includes pilot training materials and operational directives, with some files marked as 'Boeing Proprietary, Confidential, and/or Trade Secret.' The attackers have set a six-day timer for negotiations, and no data samples have been released to verify the claims. Cybersecurity experts warn that the leaked information could facilitate phishing and social engineering attacks against FlyDubai staff, posing significant reputational and legal risks. FlyDubai has not publicly responded to the claims at the time of reporting.
Ransomware · 2 sources · score 58 · Everest
Breaches
South Korea Investigates AI-Driven Bank Data Breaches
South Korean President Lee Jae Myung ordered an investigation into recent data breaches affecting several major banks, including Hana Bank, KB Kookmin Bank, Shinhan Bank, and Woori Bank. The breaches exposed personal information of tens of thousands of customers, including names, phone numbers, and annual income. Authorities are examining the possibility that AI-assisted tools were used in the attacks, with traces of a Chinese-language AI penetration-testing tool found on a server linked to the Shinhan Bank incident. The Financial Services Commission has mandated tighter security measures across the financial sector and is investigating the incidents further. No evidence has been found that sensitive information usable for unauthorized payments was compromised, but the stolen data could facilitate secondary attacks. The National Office of Investigation has opened a probe into the cyberattacks, which have raised significant public concern.
Breach · 2 sources · score 54
Threat actors and malware
US Offers $10 Million Reward for Chinese Hacker Linked to COVID-19 Research Attacks
The U.S. State Department has announced a reward of up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national accused of cyberattacks targeting U.S. COVID-19 researchers. Zhang is alleged to have worked with Xu Zewei and others under the direction of China's Ministry of State Security (MSS), conducting intrusions between February 2020 and June 2021. These attacks were part of the HAFNIUM campaign, which exploited vulnerabilities in Microsoft Exchange Server and compromised thousands of computers worldwide. The hackers targeted U.S.-based universities and organizations involved in COVID-19 research, stealing sensitive information. Xu was arrested in Italy in July 2025 and extradited to the U.S. in April 2026, facing multiple charges. Zhang remains at large, and the U.S. government is actively seeking information about him and his associates.
APT · 4 sources · score 72 · Hafnium, Hafnium Campaign, Hafnium Hacking Campaign, Hafnium Intrusion Campaign
Asos App Compromised in Public Hack Incident
On October 7, 2026, Asos faced a significant security breach when hackers hijacked the company's app to send a push notification claiming they had compromised the Snowflake instance. The message, which demanded engagement from Asos's data protection officer and IT department, was seen by users across multiple countries, including the UK, France, and Australia. Asos confirmed the unauthorized notification and stated that while basic personal information may have been accessed, payment information and passwords were not believed to be compromised. The company is currently investigating the incident and has restricted access to its notification platforms. Asos has 17 million active customers and has cyber security insurance in place. The incident has raised concerns about customer trust and the potential misuse of personal data, even though the attackers claimed that customer data was safe on their servers. The breach has resulted in a 10.6% drop in Asos's share price, reflecting investor anxiety about the fallout.
APT · 2 sources · score 52 · ShinyHunters
New on leak sites
35 victims listed on ransomware leak sites by 14 groups in the 24 hours before this issue. The most active:
Also moving
- Campaigns: FortiBleed, AI-Powered Campaign, Akrites, Canto Incognito, Center-2026
- Vulnerabilities: XSS, Arbitrary File Read Vulnerability, Cleo, Command Injection Vulnerability, CurXecute
- Ransomware groups: Alphv/Blackcat, BlackCat, BlackMatter, Cl0p
- Malware: Amatera, BaitHook, ClickFix
- CVEs: CVE-2016-4800, CVE-2017-9841, CVE-2018-14028, CVE-2018-20062, CVE-2020-15505
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.