{"data":{"id":2222,"lang":"en","title":"CISA Orders Federal Agencies to Patch Actively Exploited Flaw in Ray AI Framework","summary":"CISA gave federal agencies until August 20 to patch a critical zero-click RCE flaw in the Ray AI framework already exploited by a GPU-hijacking cryptomining botnet.","category":"technology","category_label":"Technology","published_at":"2026-08-20T14:02:36Z","updated_at":"2026-08-20T14:02:36Z","url":"https://techtools.cz/tools/news/article/2222-cisa-orders-federal-agencies-to-patch-actively-exploited-flaw-in-ray-ai","api_url":"https://techtools.cz/news-api/v1/articles/2222?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2222.md?lang=en","image_url":"https://i0.wp.com/securityaffairs.com/wp-content/uploads/2020/07/CISA.jpeg","word_count":166,"reading_time_minutes":1,"sources":[{"url":"https://securityaffairs.com/197419/security/u-s-cisa-adds-a-ray-project-ray-flaw-to-its-known-exploited-vulnerabilities-catalog.html","domain":"securityaffairs.com"},{"url":"https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html","domain":"thehackernews.com"}],"translation":{"lang":"cs","id":2295,"title":"CISA nařídila federálním agenturám opravit aktivně zneužívanou chybu v AI frameworku Ray","url":"https://techtools.cz/tools/news/clanek/2295-cisa-naridila-federalnim-agenturam-opravit-aktivne-zneuzivanou-chybu-v-ai","api_url":"https://techtools.cz/news-api/v1/articles/2295?lang=cs"},"content":"CISA added CVE-2025-62593, a critical remote-code-execution flaw in Ray — the open-source distributed computing framework used by Amazon, Apple, and OpenAI to scale AI and machine-learning workloads — to its Known Exploited Vulnerabilities catalog on August 17, giving federal agencies just three days, until August 20, to patch it.\n\nThe bug, rated 9.4 out of 10 on the CVSS severity scale, stems from Ray's dashboard checking only whether a browser's User-Agent header starts with \"Mozilla\" — a value trivially spoofed. Combined with a DNS-rebinding attack, it lets a malicious website or ad silently run code on a developer's machine the moment they visit it in Firefox or Safari, no click required.\n\nAttackers have already weaponized the flaw: unpatched Ray clusters running Nvidia GPUs have been hijacked into a self-replicating cryptocurrency-mining botnet dubbed ShadowRay 2.0, while the RondoDox DDoS botnet reportedly folded in the exploit before it was even publicly disclosed. Ray 2.52.0 fixes the issue; CISA is urging private organizations to patch on the same timeline as federal agencies."}}