SHADOWRAY: FIRST KNOWN ATTACK CAMPAIGN TARGETING AI WORKLOADS ACTIVELY EXPLOITED

Summary from the TLDR InfoSec newsletter

This article provides a deep dive into a new critical vulnerability in the open-source AI framework Ray. The vulnerability is due to a lack of authorization in the Jobs API that is disputed and thus unpatched. The article goes in-depth into the framework, the vulnerability, the IoCs, and the impact of exploitation.