Ray, the Engine Under the AI Boom, Just Hit CISA's Exploited List — and a Botnet Got There First

Ray is the distributed compute engine underneath a large share of production AI: it's what lets a team spread model training and inference across a cluster of CPUs and GPUs instead of one machine. That makes it valuable infrastructure to protect and, this week, a visible target. On August 17, CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalogue — a flaw where Ray's dashboard trusts a browser's User-Agent header as proof it isn't being reached from a hostile website, a defence that a basic DNS-rebinding trick defeats. NVD rates it 8.8; researchers found the RondoDox DDoS botnet had folded it into their toolkit two days before it was even publicly disclosed, fixed in Ray 2.52.0. The Hacker News →

That flaw is landing on top of an older, larger problem the industry hasn't finished cleaning up. Since November, Oligo Security has tracked a campaign called ShadowRay 2.0, built on a separate, more severe Ray flaw (CVE-2023-48022, CVSS 9.8) that lets an attacker reach the job-submission API with no login at all. Oligo counted more than 200,000 Ray servers still reachable from the open internet, and described the botnet's growth pattern as worm-like: a compromised cluster starts scanning for the next exposed Ray dashboard on its own, so the campaign spreads without the operators doing the legwork themselves. The payoff for whoever runs it is straightforward — one hijacked cluster alone was generating an estimated $3 million a year in on-demand compute value, now diverted to cryptomining. Oligo Security →

Ray's maintainers have a consistent answer when this comes up: the software was designed to run inside a trusted network, not exposed to the internet, so an authentication bypass isn't really a bug in that context. That's a defensible design position and also beside the point for the operators of 200,000-plus exposed servers who didn't read the deployment guidance that closely. Whatever the intended threat model was, the deployed reality is more than 200,000 internet-facing servers, two live and distinct exploitation paths into them, and attackers who don't care which one gets them in.

This is where AI security stories are heading next. The past month of Hardened issues has been about what frontier models can do; this one is about the unglamorous compute layer underneath every one of those models, and it's exposed in exactly the boring, familiar way most infrastructure gets exposed — no authentication, no network segmentation, running whatever version was current when someone first stood up the cluster.

Ask your team this week whether anyone can name every Ray cluster your organisation runs, whether any of them are reachable from the internet, and whether GPU billing anomalies would actually get noticed before the next invoice arrives.

On August 18, CISA added CVE-2026-59310, a directory-traversal flaw in VMware vCenter's Syslog server, to its Known Exploited Vulnerabilities catalogue. The flaw carries a CVSS score of 9.8 and lets an attacker with network access to vCenter execute arbitrary code with no workaround beyond patching. Researchers attribute exploitation to a suspected China-nexus APT actor deploying reverse_ssh binaries for persistent access and, in at least one case, dropping Babuk-derived ransomware on ESXi hosts — a move researchers suspect was anti-forensic cover rather than the campaign's goal. Researchers count 361 victim IPs spread over 47 countries. CCCS's own advisory, AV26-763, originally published July 30 covering this and four related VMware CVEs, was updated August 18 — the same day — to reflect CISA's KEV confirmation. Canadian Centre for Cyber Security →

None of the 47 countries named in current public reporting are confirmed as Canada specifically, but vCenter's ubiquity in enterprise virtualisation means absence from a victim list published so far is not the same as confirmed safety. Patch on the assumption that you are in scope, not on confirmation that you are.