CVE-2025-62593: Ray Code Injection Vulnerability Actively Exploited — Detection and Remediation Guide

---
title: Ray Process Spawning Shell or Script Interpreter
id: 3f8a2c14-9b6e-4d71-a5c2-8e1f4b7d9a03
status: experimental
description: Detects Ray dashboard, agent, or raylet processes spawning shells or script interpreters, consistent with post-exploitation activity following CVE-2025-62593 code injection against the Ray head node.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'ray/dashboard'
      - 'dashboard_agent'
      - 'raylet'
      - 'gcs_server'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Ray user jobs legitimately executing shell commands (entrypoint commands in submitted jobs) - baseline expected job names and filter known workloads
  - Legitimate Ray autoscaler activity
level: high
---
title: Suspicious Download or Execution on Ray Cluster Nodes
id: 6b1d9e47-2f5a-4c83-b7d1-3a9e5c8f2b64
status: experimental
description: Detects download-and-execute patterns and writes to execution-friendly temp paths on systems running Ray, indicative of payload staging after exploitation of the Ray dashboard or job API.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_ray_host:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_pipe:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '|sh'
      - '|bash'
      - 'chmod +x'
  selection_paths:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection_ray_host and (selection_pipe or selection_paths)
falsepositives:
  - Cluster bootstrap and initialization scripts during node provisioning - restrict alerting to nodes outside provisioning windows
level: medium
---
title: Network Connection to Ray Dashboard from Untrusted Source
id: 9c4e7a25-1d8b-4f36-a2c9-5b7d3e6f1a48
status: experimental
description: Detects inbound connections to the Ray dashboard port (8265) where the source is outside expected cluster and management ranges. Exposed Ray dashboards are the primary attack surface for CVE-2025-62593.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 8265
  filter_cluster_internal:
    SourceIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_cluster_internal
falsepositives:
  - Public cloud VPC addressing that overlaps RFC1918 - replace the filter with your actual cluster CIDRs and approved jump-host/management IPs
  - Load balancer health checks (typically TCP handshake only, no data)
level: high

let RayParents = dynamic(["raylet", "gcs_server", "dashboard", "dashboard_agent", "ray::"]);
let SuspiciousChildren = dynamic(["sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "socat", "perl", "python", "python3"]);
let Lookback = 7d;
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any (RayParents) or InitiatingProcessCommandLine has_any ("ray/dashboard", "raylet", "gcs_server")
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Source = "MDE"),
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where SyslogMessage has_any ("raylet", "dashboard_agent") and SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ")
    | project TimeGenerated, DeviceName = Computer, AccountName = "", InitiatingProcessFileName = ProcessName, InitiatingProcessCommandLine = "", FileName = "", ProcessCommandLine = SyslogMessage, Source = "Syslog"),
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DestinationPort == 8265
    | where not (SourceIP startswith "10.") and not (SourceIP startswith "192.168.")
    | summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
    | extend Source = "Network")
| order by TimeGenerated desc

-- Hunt for suspicious child processes of Ray components and staged payloads
-- in world-writable execution paths on Ray cluster nodes.

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(/bin/(ba)?sh|curl|wget|ncat|socat|/tmp/|/dev/shm/)'

LET ray_parents = SELECT Pid, Name, CommandLine
FROM pslist()
WHERE Name =~ '(?i)(raylet|gcs_server|python)'
   AND CommandLine =~ '(?i)(ray/dashboard|dashboard_agent|raylet)'

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       if(condition=Pid in ray_parents.Pid, then='RAY_CHILD', else='SUSPECT') AS Verdict
FROM procs

UNION ALL

-- Staged executables in temp paths modified in the last 72 hours
SELECT NULL AS Pid, NULL AS Ppid, 'FILE_ARTIFACT' AS Name,
       FullPath AS CommandLine, NULL AS Exe, NULL AS Username,
       Mtime AS CreateTime, 'STAGED_FILE' AS Verdict
FROM glob(globs=['/tmp/**', '/dev/shm/**', '/var/tmp/**'])
WHERE Mtime > (now() - 259200)
  AND NOT IsDir
  AND FullPath =~ '(?i)\\.(sh|py|elf|bin)$|^[a-z0-9]{6,12}$'

#!/bin/bash
# CVE-2025-62593 - Ray cluster exposure assessment and containment
# Run as root or via sudo on each Ray head/worker node

set -euo pipefail

echo "=== [1] Installed / running Ray version ==="
if command -v ray >/dev/null 2>&1; then
  ray --version || true
fi
python3 -c "import ray; print('ray python module:', ray.__version__)" 2>/dev/null || echo "ray python module not found in default interpreter"
ps -eo pid,user,args | grep -E "raylet|gcs_server|ray/dashboard" | grep -v grep || echo "No Ray processes running"

echo ""
echo "=== [2] Listening Ray service ports ==="
ss -tlnp | grep -E ":(6379|8265|10001|52365)" || echo "No default Ray ports listening"

echo ""
echo "=== [3] Check if dashboard is bound to 0.0.0.0 (EXPOSED) ==="
if ss -tlnp | grep ":8265" | grep -q "0.0.0.0"; then
  echo "[!] CRITICAL: Ray dashboard is bound to all interfaces. Restrict immediately."
else
  echo "[+] Dashboard not broadly exposed or not running"
fi

echo ""
echo "=== [4] Emergency containment: restrict dashboard port to localhost ==="
read -p "Apply iptables rule to drop external traffic to TCP/8265? [y/N] " REPLY
if [[ "$REPLY" =~ ^[Yy]$ ]]; then
  iptables -C INPUT -p tcp --dport 8265 ! -s 127.0.0.1 -j DROP 2>/dev/null || \
    iptables -I INPUT -p tcp --dport 8265 ! -s 127.0.0.1 -j DROP
  echo "[+] External access to 8265 blocked (cluster-internal nodes must reach head via alternate allow rules)"
  iptables -L INPUT -n --line-numbers | grep 8265 || true
fi

echo ""
echo "=== [5] Upgrade Ray to the vendor-fixed release ==="
read -p "Upgrade ray via pip to latest patched release? [y/N] " REPLY2
if [[ "$REPLY2" =~ ^[Yy]$ ]]; then
  python3 -m pip install --upgrade "ray[default]"
  python3 -c "import ray; print('Upgraded to:', ray.__version__)"
fi

echo ""
echo "=== [6] Hunt: recent suspicious temp artifacts ==="
find /tmp /dev/shm /var/tmp -type f -mtime -3 \( -name "*.sh" -o -name "*.py" -o -perm -111 \) 2>/dev/null | head -50

echo ""
echo "Done. Review section 6 output and rotate any cloud credentials reachable from this host if compromise is suspected."