
- Ray clusters remain vulnerable to remote code execution via unauthenticated Jobs API
- Threat group “IronErn440” exploits flaw with AI-generated payloads, deploying XMRig cryptojacker
- Over 230,000 Ray servers are exposed online, up from a few thousand in 2023
Ray clusters, still vulnerable to a critical severity flaw discovered years ago, are being used for cryptocurrency mining, data exfiltration, and even Distributed Denial of Service (DDoS) attacks, experts have warned.