CISA orders a three-day patch after a flaw in the Ray AI framework comes under active attack
America’s cyber-defence agency has added a single vulnerability in Ray, the open-source framework that powers a large slice of the world’s AI training and inference, to its Known Exploited Vulnerabilities catalogue, confirming that the flaw is being used in real-world attacks.
The Cybersecurity and Infrastructure Security Agency made the move on 17 August, giving federal agencies until 20 August to patch the software or stop running it, one of the tightest windows it issues.
The bug, tracked as CVE-2025-62593, is a code-injection weakness that can hand an attacker remote code execution on a vulnerable Ray deployment. In plain terms, someone who has never logged in could get a target’s machine to run commands of their choosing.
CISA does not publish exploitation details, and neither will we; the point of a KEV listing is not how the attack works but that it is already working.
The catalogue is the same mechanism...
Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE
