A Three-Day Deadline That Changed Everything
On August 17, 2026, CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to fix it. Three days. That is unusually short, and it tells you everything about how seriously the U.S. government is taking this one.
The vulnerability lives in Ray, the open-source distributed computing framework that has become the backbone of modern AI and machine learning infrastructure. With over 43,500 GitHub stars and adoption by Amazon, Apple, and OpenAI, Ray is not some obscure library gathering dust in a corner. It is the engine that scales your AI workloads from a laptop experiment to a production cluster.
And right now, it is wide open.
What Makes This Vulnerability Different
Most critical CVEs threaten servers locked away in data centers. CVE-2025-62593 threatens the machine you are sitting in front of.
The attack works through a technique called DNS rebinding. A developer running Ray locally visits a malicious webpage or sees a malicious advertisement in Firefox or Safari. That page then sends requests directly to the Ray service running on the developer's machine, bypassing the browser's same-origin policy. The result: arbitrary code execution with the privileges of the Ray process.
The CVSS 4.0 score is 9.4 out of 10. That is as close to a perfect storm as security researchers get.
The "Security" That Was Not There
Here is the part that stings. Ray's maintainers made a deliberate decision not to implement authentication on critical endpoints like /api/jobs and /api/job_agent/jobs/. Their only browser-blocking control was checking whether the HTTP User-Agent header started with the word "Mozilla."
That is not a security boundary. That is a polite suggestion.
In Firefox and Safari, attackers can manipulate the User-Agent value through browser request behavior, bypassing this filter entirely. The Ray team acknowledged this was a "longstanding decision" that "once again led to a severe vulnerability."
When your only defense is a string comparison on a header the client controls, you do not have defense. You have theater.
ShadowRay 2.0: The Botnet That Got There First
The timeline is the most alarming part of this story. Bitsight's threat intelligence team discovered that the RondoDox botnet began attempting to exploit CVE-2025-62593 on November 24, 2025. The CVE was not published until two days later.
That means threat actors were tracking public vulnerability research in real time, building exploits before the formal advisory even dropped. They were not waiting for CISA. They were not waiting for the patch. They were already inside.
The campaign, dubbed ShadowRay 2.0, does not just exploit Ray. It weaponizes it. Compromised GPU clusters are turned into self-replicating botnets capable of:
- Cryptomining using XMRig to mine cryptocurrency on stolen GPU cycles
- DDoS attacks leveraging the distributed nature of Ray clusters
- Data theft from sensitive AI workloads and training data
- Lateral movement to other exposed Ray dashboards on the same network
An unpatched Ray instance on a GPU node is not just a liability for that node. It is a potential beachhead into your entire cluster.
Why This Matters Beyond Big Tech
Ray is not limited to Fortune 500 AI labs. It runs on developer laptops, Kubernetes clusters, AWS SageMaker environments, on-premises GPU racks, and managed cloud services. Because Ray is often treated as a developer dependency rather than a production server, it frequently falls outside normal vulnerability management and patching cycles.
That blind spot is exactly what ShadowRay 2.0 is exploiting.
If your team builds AI products, trains models, or runs distributed data processing, there is a meaningful chance Ray is somewhere in your stack. And if it is, the question is not whether you should patch. It is whether you already have.
What to Do Right Now
The fix is straightforward. Upgrade to Ray 2.52.0 or later. Every prior version is affected.
But upgrading is only step one. Here is the full checklist:
- Inventory your Ray installations. Check developer laptops, CI runners, container base images, Kubernetes clusters, and cloud compute environments. Ray often hides in places teams do not think to look.
- Upgrade to Ray 2.52.0 or later. Rebuild container images that bundle older Ray versions. Verify package managers have not retained a vulnerable release.
- Restrict network access. If immediate patching is not possible, do not expose Ray dashboards or APIs to untrusted networks. Use network segmentation, authenticated proxies, VPNs, and firewall rules.
- Audit your logs. Look for unexpected job submissions, unusual API requests, suspicious browser activity, or unapproved commands executed by Ray processes.
- Review your authentication posture. Ray's default of no authentication on critical endpoints is a design choice, not a requirement. Wrap Ray behind an authenticated proxy if you must run older versions temporarily.
The Bigger Picture
CVE-2025-62593 is not just another entry in CISA's catalog. It is a case study in what happens when AI infrastructure grows faster than its security model.
Ray became critical infrastructure for the AI industry without inheriting the security expectations that come with that status. No authentication on job endpoints. A User-Agent check as the only browser defense. A nine-month window between the first exploit attempts and CISA's intervention.
The AI tools your team depends on are only as secure as the frameworks they are built on. And right now, one of the biggest frameworks just got a wake-up call.
Patch Ray today. Audit your stack this week. And start asking harder questions about the security of the infrastructure powering your AI.