Researchers at Oligo have detected a cyberattack campaign that is exploiting a vulnerability in the Ray open-source AI framework. The campaign has been operating for seven months. The vulnerability that is being exploited is one of five that were disclosed late last year. Four of the vulnerabilities were addressed in Ray version 2.8.1, but the fifth, (CVE-2023-48022) was disputed and not addressed in the update. Threat actors are exploiting the vulnerability to compromise servers storing AI workloads and network credentials. More https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
