🟠 High | Source: The Hacker News
Researchers using Kimi K3 AI agents discovered multiple zero-day vulnerabilities in Redis, leading to seven security releases on 23 July. Authenticated remote code execution proof-of-concept exploits were published for Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0, with attack chains exploiting the RESTORE command and in some cases EVAL, XGROUP, or the bundled RedisBloom module. Patched versions 6.2.23, 7.2.15, and 7.4.10 are now available and should be applied immediately.
Security Architect’s Take: Prioritise patching any internet-accessible or multi-tenant Redis instances to the fixed versions (6.2.23, 7.2.15, 7.4.10) immediately; where patching is not yet possible, restrict the RESTORE and EVAL commands via Redis ACLs and ensure Redis is not exposed beyond trusted network segments.
Original advisory: Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say