Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: AI/ML developers and organizations utilizing the Ray framework
Incident: Active exploitation of CVE-2025-62593 allowing remote code execution on Ray instances.
Impact: Full system compromise and the potential recruitment of GPU clusters into botnets or cryptominers.
Attacker: RondoDox botnet and ShadowRay 2.0 actors
Analysis: The vulnerability stems from a lack of authentication on Ray’s critical API endpoints, which attackers can leverage using DNS rebinding. By tricking a developer into visiting a malicious site, attackers can gain arbitrary shell access. This flaw has been weaponized by both DDoS botnets and cryptocurrency miners to hijack GPU-heavy clusters.
Recommendations: Update Ray to version 2.52.0 or later immediately.; Implement strict network segmentation to isolate Ray development and testing clusters.; Avoid visiting untrusted websites or clicking suspicious ads on workstations running Ray.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source