Today is the deadline. On August 18, 2026, CISA added a critical remote-code-execution flaw in Ray — the open-source Python framework that scales AI and machine-learning workloads across clusters of GPUs — to its Known Exploited Vulnerabilities catalog, and gave federal civilian agencies just three days to patch instead of the usual fourteen, per The Register. That window closes today, August 20. The bug, CVE-2025-62593, scores a 9.4 out of 10, and here's the part that should actually worry you if you run Ray anywhere near a GPU cluster: attackers didn't wait for the disclosure. They had a head start before the public even knew the bug existed.
How a framework with no login screen became a GPU botnet feeder
Ray's core design choice is the whole problem. The Ray team never put authentication on critical endpoints like /api/jobs and /api/job_agent/jobs/ — by design, for a framework meant to run inside a trusted internal network. The trouble is that plenty of Ray instances aren't actually confined to a trusted network, and CVE-2025-62593 gives attackers a way to reach even the ones that think they are.
How CVE-2025-62593 went from unknown to CISA's most urgent deadline
Nov 24, 2025
RondoDox DDoS botnet operators begin weaponizing the bug — before it's even public.
Nov 26, 2025
CVE-2025-62593 is publicly disclosed.
Early 2026
ShadowRay 2.0 campaign starts hijacking unpatched Ray clusters running NVIDIA GPUs to mine cryptocurrency.
Aug 18, 2026
CISA adds the flaw to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation, per Security Affairs.
Aug 20, 2026
Federal civilian agency patch deadline — today.
That gap between disclosure and mainstream attention is the real lesson here, not just a footnote. This bug had roughly nine months of runway before CISA forced anyone's hand, and it spent that runway being actively exploited the entire time — first by a DDoS botnet operator, then by whoever is running ShadowRay 2.0.
The trick, explained without the jargon
DNS rebinding sounds complicated. The mechanics are almost insultingly simple. An attacker sets up a malicious webpage and a DNS record that first resolves to their own server, then — after your browser has loaded the page and decided it's allowed to talk to that domain — flips to resolve to an internal IP address instead, like the Ray dashboard sitting on your local network. Your browser, following same-origin rules that were never built for this, happily sends requests to that internal Ray instance as if it were still talking to the original site. Combine that with a spoofed User-Agent header and Ray's missing authentication, and The Hacker News reports an attacker gets arbitrary shell execution just from a victim visiting a page in Firefox or Safari — no credentials exchanged anywhere in the chain.
ShadowRay 2.0 specifically targets Ray clusters running NVIDIA GPUs — hijacking real compute for cryptocurrency mining. · Unsplash
What to actually do about it
Upgrade to Ray 2.52.0 or later — this is the only real fix.
Never expose the Ray dashboard or job-submission API directly to the internet; keep it behind a VPN or a private network with no public DNS entry.
If you're a federal civilian agency, today (August 20, 2026) is your CISA-mandated deadline — this is not a next-sprint item.
Audit any Ray clusters — especially ones with GPUs attached — for unexpected job submissions or GPU utilization spikes that don't match your own workloads.
Check outbound network activity for connections tied to known ShadowRay or RondoDox infrastructure, and treat unexplained GPU load as a compromise signal first, cost anomaly second.
None of that is exotic. It's the same advice as always — patch, don't expose internal tools to the open internet, watch for anomalies — but Ray's specific failure mode, an AI scheduler with no login sitting next to genuinely expensive hardware, makes the cost of skipping it unusually literal. You're not just risking data. You're risking someone else's electricity bill running up on your GPUs.
What is CVE-2025-62593?
A critical (CVSS 9.4) remote code execution vulnerability in Ray, the open-source distributed computing framework used to scale AI and machine-learning workloads, exploitable via a DNS rebinding attack combined with a spoofed User-Agent header against Ray's unauthenticated job APIs.
Is my Ray cluster affected?
Any version prior to 2.52.0 is vulnerable. If your Ray dashboard or job-submission endpoints are reachable from outside a fully trusted, isolated network, treat this as an active exposure, not a theoretical one.
What is ShadowRay 2.0?
An ongoing campaign that scans for unpatched Ray clusters — specifically ones running NVIDIA GPUs — and hijacks them to mine cryptocurrency using the victim's own compute.
Why does CISA's deadline matter if I'm not a federal agency?
CISA's Known Exploited Vulnerabilities deadlines only bind federal civilian agencies directly, but they're a reliable signal of real-world active exploitation. Anyone running Ray should treat the same deadline as their own.
This is also a decent proxy for a bigger pattern we've been tracking on the AI-infrastructure side — the LiteLLM/Trivy supply-chain mess and Unit 42's AI-found zero-days both point the same direction: the tools built to run and secure AI workloads are shipping with the same unauthenticated-by-default assumptions as internal tools from a decade ago, except now they're sitting next to hardware worth actually stealing. If you're weighing a GPU purchase for local AI right now, add 'never expose the scheduler' to the list of things that matter more than the spec sheet.
