The open-source software that sits at the heart of AI workloads at Amazon, Apple, and OpenAI has a critical, actively exploited vulnerability — and federal agencies have until today, August 20, to patch it or take affected systems offline.
What Ray Is and Why This Matters
Ray is an open-source distributed computing framework built by Anyscale, designed to take Python workloads — machine learning training runs, model inference pipelines, data processing jobs — and scale them across clusters of CPUs and GPUs. With more than 43,000 GitHub stars and adoption at some of the largest AI companies in the world, it’s not a niche tool. When Ray has a critical vulnerability, the blast radius is potentially enormous: affected systems typically aren’t individual laptops but pools of expensive compute holding proprietary models, training data, and cloud credentials.
The Vulnerability
CVE-2025-62593 is a code injection flaw affecting Ray versions prior to 2.52.0, rated 9.4 out of 10 under CVSS v4 — effectively the highest severity tier. CISA Adding it to its Known Exploited Vulnerabilities catalog on August 17, and gave US Federal Civilian Executive Branch agencies three days to remediate, under the agency’s Binding Operational Directive 26-04, which applies its shortest window to vulnerabilities granting total control of an exposed asset after exploitation.
The attack mechanism is technically precise. Ray exposes HTTP API endpoints — including /api/jobs and /api/job_agent/jobs/ — that are designed to submit and execute code on a cluster. Ray’s intended defense against a malicious website reaching a locally running Ray instance was to check whether the HTTP User-Agent header began with “Mozilla,” on the logic that browser requests carry that prefix. The problem: Firefox and Safari both allow scripts using the Fetch API to modify that header. Combined with a DNS rebinding attack — which tricks a browser into connecting to a local address after initially resolving to a benign external one — an attacker can reach the Ray API through a developer’s browser and execute arbitrary code simply by persuading that developer to visit a malicious site or see a malicious advertisement.
Already Actively Exploited in the Wild
CISA’s KEV listing reflects confirmed active exploitation, not just theoretical risk. Security firm Bitsight linked the vulnerability to RondoDox, a DDoS botnet known for aggressively scanning the internet for exploitable endpoints, which began incorporating a proof-of-concept for this flaw as early as November 24, 2025 — two days before the CVE was formally published. Researchers at Oligo Security separately tracked a campaign called ShadowRay 2.0 that specifically targets AI infrastructure clusters equipped with high-end Nvidia GPUs, compromising them for cryptomining and other purposes. The flaw was first disclosed in November 2025; its trajectory from disclosure to active exploitation to federal emergency patch order took less than nine months.
The Fix and What To Do
The vulnerability is patched in Ray 2.52.0. For any organization running Ray in a development or production environment, the immediate action is straightforward: identify any Ray installation older than 2.52.0 and update it, with particular urgency on machines that run Ray while also browsing the web in Firefox or Safari. CISA additionally recommends isolating Ray deployments from internet-accessible surfaces wherever possible — a reminder that Ray was architected as a trusted internal compute framework, not a public-facing service, and exposing its API endpoints to the internet was never an intended configuration.
Part of a Bigger Pattern
This incident joins a growing catalogue of AI infrastructure vulnerabilities disclosed in 2026. Where earlier security stories this year focused on AI agents escaping their sandboxes or AI coding tools introducing flaws into production code, this one sits a layer deeper: the compute framework itself, used to run the models rather than built by the models, being actively exploited to steal the GPU clusters that make large-scale AI possible. It’s a reminder that securing AI systems means securing not just the models and the products built on top of them, but the entire infrastructure stack underneath — a point covered from a different angle in our reporting on the Wiz Red Agent finding exploits in Snowflake’s pipeline.
Sources: CISA KEV Catalog, The Hacker News, The Register
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
