Hackers exploit Ray framework flaw to breach servers, hijack resources

ShadowRay is an active campaign exploiting a design-related remote code execution issue (CVE-2023-48022) in the Ray open-source AI framework to hijack compute resources, exfiltrate sensitive artifacts (models, environment variables, DB credentials, cloud tokens), and deploy Monero miners and reverse shells; Oligo found hundreds of publicly exposed Ray servers compromised and recommends restricting network exposure, adding authorization, and continuous monitoring.