CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
Summary: CISA added CVE-2025-62593, a CVSS 9.4 flaw in the open-source Ray distributed computing framework, to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation. The defect allows remote code execution through DNS rebinding attacks in Firefox and Safari against developers running Ray, and was fixed in version 2.52.0.
What you should know: The RondoDox DDoS botnet operators added this flaw to their arsenal two days before it was publicly disclosed on November 26, 2025, and unpatched Ray clusters with NVIDIA GPUs have been pulled into the ShadowRay 2.0 cryptocurrency mining botnet - with FCEB agencies given until August 20, 2026 to apply fixes.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-62593
- Related
- CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability Known Exploited Vulnerabilities · Aug 17, 2026Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026