As reported by The Hacker News, CISA has added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, confirming that a critical Ray framework flaw is being actively exploited in the wild. This is not a theoretical concern — it is a live attack surface that AI/ML teams need to address immediately.
Why This Vulnerability Is Worse Than It Looks
The CVSS 9.4 rating undersells the real-world risk. The attack chain — DNS rebinding combined with Ray's complete absence of authentication on job submission endpoints — means that a developer simply visiting a compromised webpage or being served a malicious ad can trigger arbitrary shell execution on their local Ray instance. The browser becomes a confused deputy, bridging the attacker's public web context into the developer's private network. From there, adjacent Ray clusters inside the corporate network become reachable, expanding blast radius far beyond the initial victim's workstation.
The root cause is architectural: Ray's maintainers made a deliberate decision to ship without authentication on critical endpoints. That design choice, intended for development convenience, has now produced two severe CVEs and fueled both DDoS botnet conscription and cryptojacking operations.
Who Is Most Exposed
The RondoDox DDoS botnet incorporated this flaw into its arsenal before public disclosure, leveraging a proof-of-concept exploit. That timeline indicates either early private leak or independent rediscovery — either way, defenders should assume multiple threat groups possess working exploits.
Shield53 Recommendations
Immediate Actions
- Patch now: Upgrade all Ray installations to version 2.52.0 or later. This is non-negotiable for any instance, including local dev environments.
- Network segmentation: Ensure Ray dashboard and API ports (default 8265) are never exposed to the public internet. Restrict access to authenticated VPN or bastion-host paths only.
- Browser hardening for developers: Deploy DNS rebinding protections — disable DNS rebinding in corporate DNS resolvers, enforce strict same-origin policies, and consider browser extensions that block cross-origin requests to private network ranges.
- Hunt for compromise: Review Ray job logs for unexpected job submissions, examine GPU node telemetry for unauthorized cryptomining processes, and audit outbound traffic from Ray cluster nodes for C2 indicators.
- Inventory all Ray deployments: Many organizations don't know where Ray is running. Check developer workstations, CI/CD pipelines, shared GPU servers, and cloud ML platforms. Shadow ML infrastructure is a major blind spot.
Strategic Considerations
This vulnerability highlights a persistent problem in the AI/ML tooling ecosystem: frameworks optimized for research velocity frequently ship with dangerous defaults. Security teams should evaluate all ML infrastructure components — not just Ray — for missing authentication, default-open dashboards, and browser-accessible APIs. The pattern of DNS rebinding attacks against local development services is growing, and Ray will not be the last framework targeted this way.
For FCEB agencies, CISA's KEV addition triggers BOD 22-01 remediation requirements. Private sector organizations should treat KEV-listed vulnerabilities with the same urgency regardless of mandate — the catalog has become a reliable signal of active threat actor toolkits.
