---
title: "Security digest: November 26, 2025"
url: https://erroneo.us/security/2025-11-26/
description: "November 26, 2025 vulnerability digest: 1 brief (Ray CVE-2025-62593: Browser-Driven RCE Against…); 3 critical advisories (Maven, PyPI). What to patch and…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-11-26
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 26, 2025

1 editorial brief and 3 critical advisories.

## Take stock

- Patch this week: Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs . Developers and data scientists who run Ray below 2.52.0 locally or on internal clusters and browse with Firefox or Safari, and any team whose Ray dashboard is reachable from employee browsers or the internet.
- PyPI: 2 critical advisories ( ray ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( org.apache.druid:druid ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs](https://erroneo.us/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/index.md): Upgrade Ray to 2.52.0 or later on developer machines and internal clusters this week; the attack needs a Firefox or Safari user to load a hostile page while a pre-2.52 dashboard is running, and the public evidence of real-world use is thin.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-59390](https://erroneo.us/security/cve/CVE-2025-59390/index.md) Apache Druid’s Kerberos authenticator uses a weak fallback secret — Maven org.apache.druid:druid < 35.0.0 → 35.0.0
- [CVE-2025-62593](https://erroneo.us/security/cve/CVE-2025-62593/index.md) Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack — PyPI ray < 2.52.0 → 2.52.0
- [CVE-2025-34351](https://erroneo.us/security/cve/CVE-2025-34351/index.md) Ray's New Token Authentication is Disabled By Default — PyPI ray <= 2.52.0 → no fix

---
Source page: https://erroneo.us/security/2025-11-26/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt