CISA says attackers are exploiting a critical 2025 vulnerability in Ray, the widely used open source framework for scaling Python and machine-learning workloads. Tracked as CVE-2025-62593 and rated 9.4 under CVSS v4, the bug was first disclosed in November 2025. It allows an attacker to use Firefox or Safari to achieve remote code execution (RCE) on a vulnerable Ray system. The open source distributed computing framework is used and supported by major tech companies, including Amazon, Apple, and OpenAI. Vulnerable Ray versions try to identify and block browser requests by checking whether the User-Agent header begins with "Mozilla." Firefox and Safari, however, allow scripts using the Fetch API to modify that header. A developer running Ray could trigger the exploit simply by visiting a dodgy website or receiving a malicious ad in an affected browser. The attacker can then use DNS rebinding to reach the local Ray service. "This vulnerability impacts developers running development/testing environments with Ray," the project's developers explained. "If they fall victim to a phishing attack, or are served a malicious ad, they can be exploited, and arbitrary shell code can be executed on their developer machine. "This attack can also be leveraged to attack network-adjacent instances of Ray by leveraging the browser as a confused deputy intermediary to attack Ray instances running inside a private corporate network." Ray 2.52.0 fixes the flaw. CISA gave US federal civilian executive branch agencies three days to remediate it, rather than the standard 14. CISA did not explain the urgency, and marked the catalog's "known to be used in ransomware campaigns" field as "unknown." However, Binding Operational Directive 26-04 allows the agency to impose a three-day remediation window on vulnerabilities it considers especially risky. Ray is an open source framework that helps developers scale Python and machine-learning workloads from a local environment to a cluster with minimal code changes. Now managed by the Linux Foundation's PyTorch Foundation, the project started at UC Berkeley and was commercialized via Anyscale, the startup founded by Ray's developers in 2019. According to Anyscale's figures as of October 2025, Ray had more than 237 million total downloads, and 7 million per week – representing a near-tenfold growth year-on-year. Product analysis site NextSprints estimates that Ray has 1 million monthly active users and is used by 60 percent of Fortune 500 companies. The security advisory blamed Ray's longstanding lack of authentication on critical endpoints for making the attack possible. Ray's security model historically assumed that clusters would run inside a trusted, isolated network, leaving authentication and access control to the surrounding infrastructure. Ray 2.52.0 introduced optional token-based authentication as an additional defense against unauthorized access, although it remains disabled by default. The project continues to recommend deploying clusters inside a controlled network rather than treating authentication as a substitute for isolation. ®
