CISA Warns of Exploited Ray Vulnerability; T-Mobile Cut Cable to Stop Chinese Hackers

CISA Mandates Patch for Actively Exploited Ray Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal civilian agencies to address a severe code injection vulnerability, identified as CVE-2025-62593, in Ray-Project Ray. This directive follows the flaw's inclusion in the Known Exploited Vulnerabilities catalog, indicating active abuse by threat actors in real-world scenarios.

BitSight observed the RondoDox botnet exploiting this vulnerability. RondoDox, a botnet inspired by Mirai, utilizes 174 different exploits to compromise vulnerable edge devices, highlighting the widespread threat posed by this specific flaw.

T-Mobile Physically Disconnects Network to Counter State-Sponsored Attack

In 2024, T-Mobile's cybersecurity team took the measure of physically cutting a router cable to halt an active network intrusion. The intrusion was attributed to Salt Typhoon, a Chinese state-sponsored hacking group. This action was taken to prevent further compromise of their systems.

GitHub Clarifies Origin of Vulnerability Found by AI Tool

An autonomous AI tool developed by Wiz successfully identified and exploited a critical GitHub Actions workflow vulnerability within a public Snowflake repository, leading to unauthorized access to the company’s internal Jira tickets. Initially, reports suggested GitHub Copilot introduced the flaw.

However, GitHub clarified that the vulnerable code snippet was entirely human-authored, not generated by AI. This distinction addresses concerns about AI's role in introducing security vulnerabilities.

New Linux Botnet Evooo1Bot Emerges

FortiGuard Labs is tracking Evooo1Bot, a new Linux botnet characterized by its modular design. This Mirai variant targets internet-facing devices by exploiting over a dozen known CVEs. Beyond standard DDoS capabilities, Evooo1Bot includes an SSH brute-forcer, a credential sniffer, and a SOCKS5 relay module. These features allow it to convert infected hosts into persistent proxy nodes for attackers, expanding its utility beyond denial-of-service attacks.