On October 7, 2026, Lumen Black Lotus Labs detailed ’Canto Incognito’, a campaign that infects more than 3,400 exposed servers — LiteLLM, Gotenberg, Gitea, Ivanti Sentry — to turn them into cryptocurrency miners, hiding its command-and-control address inside a poem hosted on GitHub. Any internet-facing AI instance must be inventoried, because that surface is exactly what the campaign scans to grow.

On August 20, 2026, Trend Micro disclosed fourteen functional npm packages that drop RedShell, the Linux beacon of the RedC2 4.0 C2 framework, with no install hook and no exported function call. Audit your transitive dependencies and recent package additions before a single import compromises your servers.