CISA's new three-day patch rule just landed on Ray, the AI framework whose own maintainer still disputes a second, actively exploited flaw is a bug at all

On August 17, the Cybersecurity and Infrastructure Security Agency added a Ray vulnerability to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until August 20 to patch it — 3 days (CISA's remediation deadline, the tightest tier its framework allows) — after confirming it was already under active attack. Ray is the open-source framework that coordinates distributed AI compute: it schedules training jobs, serves models, and spreads hyperparameter searches across clusters of machines. The flaw, tracked as CVE-2025-62593, lets an attacker who gets a developer to load one malicious web page hijack that developer's local Ray instance through nothing more exotic than an open browser tab.

Anyscale maintains Ray day to day; at the governance level it now sits inside the Linux Foundation's PyTorch Foundation. The project has logged more than 237 million downloads and roughly 7 million a week as of last October — near-tenfold growth in a year, by Anyscale's own count — and it runs underneath production systems at OpenAI, where it coordinates ChatGPT's training pipeline, and at Uber's Michelangelo machine-learning platform. By Anyscale's own numbers, Ray now orchestrates more than 1 million compute clusters a month, with roughly 120,000 distinct GPU clusters running the software in a given week. The Register, citing product-analytics site NextSprints, put Ray's reach at roughly 1 million monthly active users and use inside 60% of the Fortune 500 — an outside estimate neither company has confirmed, but directionally consistent with download counts an order of magnitude past what a niche tool would show.

The reason Ray can do this kind of damage at all is the same reason it's useful: a distributed job scheduler has to be able to push code onto every worker node in a cluster and run it, on demand, without a human approving each job. That's the entire product — hand it a training script, and Ray fans it out across however many machines are available. Governance for the project itself sits with the Linux Foundation's PyTorch Foundation, a neutral nonprofit steward; day-to-day maintenance, security advisories, and — as it turns out — the final word on what counts as a vulnerability all still run through Anyscale, the venture-backed company that commercializes Ray. Those are two different incentive structures answering to the same GitHub repository.

Ray currently has two separate authentication problems open at once, and they are not the same bug wearing two ID numbers. They differ in mechanism, in patch status, and, most tellingly, in whether Ray's own maintainer agrees a fix was owed at all.

The one CISA just flagged

CVE-2025-62593 lives in how Ray's dashboard decides whether a browser request is trustworthy. The defense checked whether a request's User-Agent header started with the string "Mozilla" — a check Firefox and Safari both let a malicious page rewrite via the Fetch API. Combine that with a DNS-rebinding attack, and a page a developer merely visits can reach the dashboard's `/api/jobs` and `/api/job_agent/jobs/` endpoints and submit code for Ray to run. Oligo researcher Avi Lumelsky found the fetch-header bypass; security researcher Jonathan Leitschuh worked out the DNS-rebinding delivery mechanism.

What makes the browser vector unusual is that it defeats an assumption most Ray operators actually hold. Unlike CVE-2023-48022, which requires a Ray dashboard to be reachable from the open internet, CVE-2025-62593 works against instances sitting behind a firewall on a private network — the exact setup Anyscale recommends. DNS rebinding tricks a victim's own browser into acting as the network intermediary: the malicious page first resolves to an attacker-controlled server to pass the browser's security checks, then rapidly re-resolves the same hostname to an internal IP address the browser still trusts. The Register described the resulting technique as turning the browser into "a confused deputy intermediary" that reaches into a private corporate network on the attacker's behalf. A developer never has to expose anything; they just have to browse the web with Ray running.

The flaw was live before most of the security world had heard of it. According to a March 2026 BitSight report, the RondoDox DDoS botnet had already folded CVE-2025-62593 into its toolkit two days *before* the November 2025 public disclosure. Ray 2.52.0 patches the underlying bug outright — but the release's other defense, an optional token-authentication flag, still ships off by default, which matters more than it sounds like once the second CVE enters the picture.

Three days is not CISA's normal cadence — it's the outer edge of a new one. Binding Operational Directive 26-04, issued in June 2026, replaced flat, CVSS-based deadlines with a four-variable risk matrix: whether the asset is publicly exposed, whether the vulnerability is already on the KEV list, whether exploitation can be automated, and how severe the technical impact is if it succeeds. A vulnerability that trips all four gets three days; fewer criteria get 14 or 60. Ray's browser bug tripped all four, which is why a 9.4-severity flaw — not the more severe one still sitting unpatched — got the fastest clock CISA has ever run.

The directive's timelines are also built to move, not just to be assigned once. Removing an asset from public exposure changes its "publicly exposed" variable from yes to no, which resets the clock to a slower tier — meaning an agency can buy itself time by isolating a Ray dashboard from the internet even before a patch ships, and lose that time back the moment the dashboard is reachable again. It's a deadline calculated off live network conditions rather than a fixed calendar entry, which is a meaningfully different compliance posture than the flat, all-vulnerabilities-alike 14-day window CISA ran before this year.

A second flaw Anyscale still won't call a bug

CVE-2023-48022 is the more severe number on paper — CVSS 9.8 against 9.4 — and it has had no patch since it was disclosed in 2023. Anyscale's position, stated in its own advisory, is that this isn't an oversight: it's "a long-standing design decision based on how Ray's security boundaries are drawn and consistent with Ray deployment best practices." The company's argument is that Ray's job-execution model requires the ability to run arbitrary code across a cluster by design, and that authentication doesn't fix a cluster that was never supposed to be reachable from the open internet in the first place.

It's worth being precise about what "disputed" means here, because it isn't a fringe reading. MITRE assigned the CVE number, NVD scored it 9.8, and Google's Open Source Vulnerabilities database lists it — three separate, independent cataloguing bodies with no commercial stake in Ray treated the report as a real vulnerability worth tracking. Anyscale's advisory doesn't dispute the technical mechanism any of them describe; it disputes the label, arguing the mechanism is intended behavior for software deployed the way Ray's documentation says it should be. That's a narrower disagreement than "there's no bug here" — and it's exactly the kind of disagreement a scorecard, not a headline, is built to hold.

Anyscale went further, in the same advisory, and said it had specifically *avoided* adding authentication because it worried operators would trust the mechanism too much — that a login screen would create "the facade of security without properly securing their clusters in the way they imagined." The company did concede that reasonable people could disagree, and promised an optional feature for defense-in-depth. That promise is the same token-authentication flag that shipped, still opt-in, in Ray 2.52.0 in 2026 — meaning the fix for the disputed 2023 flaw and the patch for the newly KEV-listed 2025 flaw arrived in the same release, under the same disabled-by-default setting.

The botnet that turned the dispute into a live incident

The dispute stopped being theoretical within months. In March 2024, Oligo documented the first ShadowRay campaign: attackers scanning for exposed Ray dashboards and using the unauthenticated Jobs API to run cryptomining code across hijacked GPU clusters. At the time, Oligo found a few thousand exposed instances. By November 2025, in a campaign Oligo calls ShadowRay 2.0, that number had grown by roughly a factor of ten.

The economics explain why GPU clusters specifically became worth this much effort. Industry cryptojacking data compiled by CoinLaw puts the exchange rate at roughly $1 mined for every $53 in compute cost the victim absorbs — cryptojacking has never been about the mined currency being valuable; it's about someone else paying the electricity and hardware bill. A stolen CPU instance is a nuisance. A stolen Ray cluster is a rack of the same H100- and Blackwell-class GPUs that command several dollars an hour on the open market precisely because AI labs can't get enough of them — which is exactly why Oligo values a single hijacked cluster at more than $3 million a year in on-demand compute, an order of magnitude past what the CPU-cryptojacking cases of the 2020s ever generated per target.

The attackers, tracked under the name IronErn440, have moved well past simple cryptojacking. ShadowRay 2.0's payloads disguise malicious processes as legitimate Linux kernel worker services, throttle CPU usage to roughly 60% to stay under monitoring thresholds, and hide GPU activity from Ray's own dashboards. Oligo says one hijacked cluster alone represented more than $3 million a year in on-demand compute cost, and that the campaign's targets skew toward active startups, research labs, and cloud-hosted AI environments — exactly the profile of a team that spun up Ray fast and never closed the dashboard to the internet.

This isn't just another cryptojacking campaign. It's the foundation of a multi-purpose botnet capable of DDoS attacks, data exfiltration, and global autonomous propagation.

The campaign's infrastructure has also proven hard to kill outright. GitLab removed IronErn440's malware-distribution account on November 5, 2025, after Oligo reported it; the group migrated to GitHub within five days; GitHub blocked that account on November 17; a replacement appeared within hours. Oligo's analysis of the payloads' code structure, comments, and error-handling patterns concluded they were likely AI-generated — one of the first documented cases of AI-written malware targeting AI infrastructure at scale.

What's actually fixed, and what a Ray operator should check today

The severity gap runs backwards from what got the government's fastest deadline. CVE-2023-48022 is the more dangerous flaw by score, has no patch, and is being actively monetized by a growing botnet — yet it isn't the one CISA just listed, because BOD 26-04 weighs exploit automation and KEV status alongside raw severity, and the disputed flaw isn't formally in the KEV catalog the way CVE-2025-62593 now is.

For an operator, the practical checklist is narrower than the two-CVE history suggests. Ray 2.52.0 patches CVE-2025-62593 outright — upgrading closes that door regardless of any settings. The token-authentication flag that addresses CVE-2023-48022 has to be turned on by hand; it will not protect a cluster left on its default configuration. And Anyscale's own newer verification tooling can tell an operator directly whether their dashboard is reachable from the open internet at all, which is the condition every one of these incidents has required.

None of the public reporting names OpenAI, Uber, or any other large Ray user as having run an exposed cluster — the companies whose scale explains why Ray matters are not the companies whose misconfiguration explains why ShadowRay works. Oligo's stated victim profile is smaller and faster-moving: startups, research labs, and cloud-hosted teams standing up a cluster to hit a deadline, not enterprise platform teams with a change-review process. That's the actual shape of the exposure — not that a famous name is quietly compromised, but that the tool famous names depend on is trivial for a much smaller, less careful team to leave open, and the resulting botnet doesn't check whose logo is on the account before it starts mining.

None of this is unique to one open-source project. Ray's situation is what happens when a tool built for trusted, internal clusters becomes infrastructure teams reach for under deadline pressure, on networks it was never audited for. What's unusual is having both failure modes documented on the same project at the same time: a patched, fast-moving browser exploit that just earned the federal government's newest and shortest deadline, and an older, higher-severity one that a botnet has spent two years proving is exploitable at scale — while the company that built the software still calls it working as intended.

The federal deadline only binds federal civilian agencies, but BOD 26-04's authors were explicit that the risk math behind it — public exposure, KEV status, exploit automation, technical impact — was built to travel. ComplianceHub.Wiki's read is that the four-variable standard is likely to show up in FTC Section 5 unfairness analyses and state attorney-general investigations as a benchmark for what 'reasonable' patching looks like, well outside government networks. If that holds, the gap this story documents — a lower-severity, patched flaw getting three days, and a higher-severity, disputed one getting none — becomes a template other regulators and plaintiffs' lawyers can point to directly, not just a quirk of one framework's history.

For now, the two numbers sit side by side on the same GitHub repository, governed by the same neutral foundation, maintained by the same commercial company, patched by the same point release — and rated, by every institution with a formal opinion except the one that built the software, as two vulnerabilities rather than one bug and one design choice.