CISA orders urgent remediation for actively exploited Ray RCE flaw

Summary

CISA said attackers are exploiting CVE-2025-62593, a critical Ray vulnerability with a CVSS v4 score of 9.4. The browser-based attack can reach developer machines or private networks through DNS rebinding, and Ray 2.52.0 contains the fix.

Why it matters

Developer infrastructure used for machine-learning workloads can become an entry point into private environments, making exposure-aware remediation more urgent than routine patch scheduling.

Related coverage

• Rapid7 says AI is compressing the vulnerability-to-exploitation cycle
• ValidateHTML finds pervasive markup and accessibility failures across top domains
• Researchers show how Copilot can be induced to expose connected data

Sources

• CISA gives feds 3 days to fix actively exploited Ray RCE bug