CISA Gave Agencies Three Days. The Bug Was Nine Months Old.

THE HYPE INDEX · THURSDAY, AUGUST 27, 2026

The most dangerous software in your company right now is probably not on anyone's asset list. It is the plumbing under your AI work.

On August 18, CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies three days to fix it. The standard window is fourteen. Three days is the agency saying this is already being used against people.

The flaw is in Ray, the open source framework for distributed Python and machine learning workloads, now under the PyTorch Foundation. It scores 9.4 on CVSS v4. The mechanics are ugly in a specific way. Ray does not authenticate its critical endpoints. It tries to compensate with a browser-detection check, and that check can be defeated by rewriting a header through the Fetch API. Chain that with DNS rebinding and a developer can be compromised by visiting a web page. No phishing attachment. No credential theft. Just a bad ad on a normal site.

The vulnerability was disclosed in November 2025. The fix landed in Ray 2.52.0. Nine months later CISA had to invoke an accelerated timeline under Binding Operational Directive 26-04, which tells you how many clusters never got patched.

Ray is not obscure. Anyscale reported over 237 million total downloads as of October 2025, running around 7 million a week. That is infrastructure scale.

But here is the part that should worry a CIO. Ray usually arrives sideways. A data science team stands up a cluster to train something. It runs on a developer laptop, or on cloud instances billed to a research budget, or inside a container someone built from a tutorial. It never goes through the intake process that governs your production estate, because nobody thinks of a training job as production.

So when CISA publishes a three-day deadline, the honest answer at most companies is that nobody knows where Ray runs, who owns those clusters, or whether they were ever patched. The vulnerability is not the interesting problem. The absence of an owner is.

And Ray has company. This month researchers from Cyera showed at DEF CON 34 that one weakness in the Pyodide sandbox punched through seven separate products, including n8n at CVSS 9.9, Cohere's Terrarium at 9.3, Grist at 9.1, and Hugging Face smolagents at 8.3. Same story. Shared open source component, many downstream products, one flaw. Separately, a llama.cpp use-after-free in llama-server, CVE-2026-43631, was published on August 7 at 9.2, reachable over the network with no authentication.

Run one query. Find every host in your environment running Ray, and every host running a local model server like llama.cpp. Do it by process and open port, not by asking teams to self-report, because self-reporting is how these got missed the first time.

Then answer two questions per cluster you find. Who owns it, and is it reachable from anything a browser can touch. If a machine learning cluster has no named owner, you do not have a patching problem. You have an inventory problem wearing a patching costume, and the next KEV entry will find it the same way this one did.

CISA KEV catalog, the priority list. Free, machine-readable, and it only contains vulnerabilities with confirmed exploitation. Wire it into your ticketing system so KEV entries jump the queue automatically instead of waiting on a monthly review.

Runtime asset discovery, the honest inventory. Whatever tool you already own that sees running processes and listening ports. The point is not the vendor. It is that discovery has to be observed, not declared.

OpenSSF Scorecard, the dependency check. Scores open source projects on security practices like maintenance activity and code review. Useful before a team standardizes on a framework, which is the last cheap moment to ask the question.

AI code quality. Veracode testing found AI-generated code passed security checks 56 percent of the time, with 44 percent of tests containing OWASP Top 10 vulnerabilities. Java came in at 30 percent, Python at 63.

Patch quality. A 1Password study of more than 6,000 AI-generated patches found only 26 percent fully fixed the vulnerability without side effects, and more than half failed to close the whole exploit path.

Exploit speed. Researchers used public AI models to build a working exploit chain for a zero-click Zoom flaw in under 24 hours, across Windows, macOS, iOS and Android.

In 1904 the city of Baltimore burned for roughly 30 hours and lost more than 1,500 buildings. Fire engines came from Washington, Philadelphia, and as far as New York to help.

Most of them could not connect to Baltimore's hydrants. Hose couplings were not standardized, and the visiting companies had threads that did not match. Crews stood next to working water supplies watching a city burn. The National Fire Protection Association had proposed a national standard the year before. Cities had not seen the urgency.

Shared infrastructure only feels like somebody else's problem until the day it is yours, and by then the fitting either matches or it does not.

Posting everywhere means rewriting one idea six times, so you post to one, or none. SureThing turns one idea into native posts for every platform.

Put It on Autopilot

Mark Lynd, Editor