Loading story…
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-62593, was discovered in the Ray AI compute engine, affecting developers using Ray as a development tool. The flaw is exploitable through Safari and Firefox browsers due to insufficient browser-based attack defenses, specifically relying on the User-Agent header for protection, which can be bypassed according to the fetch specification. Attackers can leverage DNS rebinding techniques to exploit this vulnerability if a developer visits a malicious website or is exposed to malvertising, potentially allowing remote code execution on the developer's system. The vulnerability has been addressed in Ray version 2.52.0, and users are urged to update to this version to mitigate the risk.
Security researchers highlighted that the vulnerability is particularly dangerous because it targets developers in their local environments, making it possible for attackers to gain unauthorized access and control. The issue was rated as critical with a CVSS score of 9.4, underscoring the severity of the threat. The Ray project has released security advisories and patches, and organizations using Ray in development should prioritize applying the update to prevent exploitation through browser-based attacks on Safari and Firefox.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A public disclosure described CVE-2025-62593 as a critical RCE issue in Ray, with CVSS v4.0 score 9.4. The advisory explained that attackers could exploit insufficient browser-attack protections via Safari or Firefox if a developer visited a malicious site or malvertising content.
Ray patched a critical remote code execution vulnerability, CVE-2025-62593, in version 2.52.0. The flaw affected versions prior to 2.52.0 and could be exploited through Safari and Firefox using a DNS rebinding attack against developers running Ray.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2025-62593** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical flaw in the open-source distributed computing framework **Ray**. The vulnerability is a code injection issue that can lead to **remote code execution** through a **DNS rebinding** attack involving browsers including **Mozilla Firefox** and **Apple Safari**, with developers running Ray in development or testing environments facing the greatest exposure. CISA updated the KEV entry to reflect an earlier `dateAdded` and moved the federal remediation deadline up to **August 20, 2026**. Ray maintainers said the issue was caused by unauthenticated critical endpoints and inadequate protections against browser-based attacks, and they released a fix in **Ray 2.52.0**. Reporting tied the flaw to multiple real-world abuse cases before and after disclosure, including weaponization by the **RondoDox** DDoS botnet operators and separate exploitation of unpatched Ray instances in **ShadowRay 2.0**, a cryptocurrency-mining campaign observed by Oligo. CISA said known ransomware use is unknown and advised organizations to apply vendor mitigations and follow its remediation and forensic triage guidance.
Aug 18, 2026
A global cybercriminal campaign, dubbed ShadowRay 2.0, is actively exploiting a critical unpatched vulnerability (CVE-2023-48022) in the open-source Ray distributed computing framework, which is widely used for AI workloads. Attackers, tracked as IronErn440, are leveraging the Ray dashboard API to achieve unauthenticated remote code execution, allowing them to hijack exposed Ray clusters and convert them into a self-replicating botnet. This botnet is used for cryptocurrency mining, data and credential theft, and launching distributed denial-of-service (DDoS) attacks. The campaign represents a significant evolution from previous ShadowRay attacks, with new techniques and AI-generated payloads observed, and is believed to have been active since at least September 2024. Despite the severity of the vulnerability, which carries a CVSS score of 9.8, no patch has been issued, as the original vendor, Anyscale, maintains Ray is intended for use in strictly controlled environments. The attack surface has grown dramatically, with over 200,000 Ray servers now exposed to the internet, many belonging to startups, research labs, and cloud-hosted AI environments. The attackers have demonstrated advanced evasion tactics, such as limiting CPU usage and disguising malicious processes, and have migrated their payload delivery infrastructure from GitLab to GitHub. The Ray project has since been transferred to the Linux Foundation's PyTorch Foundation, but the vulnerability remains unaddressed, leaving a large number of systems at risk of compromise and abuse for illicit cryptomining and other malicious activities.
Jun 29, 2026
Researchers disclosed a browser networking flaw dubbed **`0.0.0.0 Day`** that allows malicious websites to send HTTP requests to services bound to localhost by targeting **`0.0.0.0`**, bypassing expected browser protections on macOS and Linux. The issue affects major browsers through inconsistent handling of localhost and private network requests, enabling state-changing actions and, in some cases, **remote code execution** against local services even when attackers cannot read responses because of CORS. Apple, Google, and other browser vendors have acknowledged the problem and moved to block or restrict **`0.0.0.0`** as a destination, while Windows is largely unaffected because the operating system already blocks such traffic. The flaw was tied to active exploitation campaigns against AI and automation infrastructure, including **ShadowRay** attacks on publicly exposed **Ray** clusters via the Ray Dashboard and Jobs API, as well as attacks on **Selenium Grid** and **PyTorch/TorchServe** instances. Oligo reported hundreds to thousands of compromised Ray servers, with attackers stealing cloud and SaaS credentials, exposing private keys, establishing reverse shells, and deploying cryptominers such as **XMRig** and **NBMiner**; Wiz separately documented **SeleniumGreed**, in which exposed Selenium Grid services were abused for cryptomining. Defenders were urged to stop exposing Ray dashboards and Selenium services to the internet, add authentication and authorization layers, enforce network isolation and firewalling, and harden local services with CSRF protections, host validation, HTTPS, and browser-related private network controls.
Jul 24, 2026