'Thousands' of businesses at mercy of miscreants thanks to unpatched Ray AI flaw

A critical remote-code-execution vulnerability (CVE-2023-48022, "ShadowRay") in the Ray AI framework (notably in versions 2.6.3 and 2.8.0) is being actively exploited in the wild, enabling unauthenticated attackers to submit jobs, execute code as root on exposed deployments, steal credentials and SSH keys, exfiltrate sensitive data from affected organizations, and repurpose GPU-equipped clusters for cryptocurrency mining; the flaw carries a 9.8 CVSS score and has been exploited against medical, analytics, educational, and other victims over several months.