SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
PoeLLM malware finds its C&C server hidden in a GitHub poem
Black Lotus Labs has detailed PoeLLM, a malware active since at least April 2026 that targets exposed AI and open-source services (mainly LiteLLM, Ollama, Gotenberg and Gitea) to mine cryptocurrency and expand its botnet. Infected machines extract four keywords from a poem hosted on GitHub and convert them into the IP address of the current C&C server, so the operator can switch servers by changing those words. The operator, assessed to be Italian-speaking, has updated the poem 11 times.
GhostAction secret theft spreads to 772 more GitHub repos
GitGuardian says the GhostAction supply chain campaign pushed its secret-stealing GitHub Actions workflow to 772 public repositories (belonging to 373 users and organizations) between August 31 and September 30, targeting 2,577 secrets such as SSH keys and Azure, AWS and database credentials. Apart from a new exfiltration server, the attacker reused the 2025 playbook, and GitGuardian’s data shows the campaign never really stopped.
Jury convicts Uranium Finance hacker