For years, Redis was that silent piece of infrastructure keeping the digital world running without seeking attention. In architecture…

A Critical (CVSS 10.0) Use-After-Free flaw (CVE-2025-49844) in Redis's Lua parser allows authenticated attackers to achieve Remote Code Execution. Update immediately to v8.2.2.

Cybersecurity experts at Doctor Web have identified a highly sophisticated Android backdoor hiding in maliciously modified versions of the Telegram X messenger. Dubbed Android.Backdoor.Baohuo.1.or…

Redis, the world’s leading in-memory data platform, has issued an urgent patch addressing a high-severity vulnerability (CVE-2025-62507, CVSSv4 7.7) that could allow remote code execution (RCE) un…

MAD-CAT is a security tool to simulate data corruption attacks against MongoDB, Elasticsearch, Cassandra, and other databases in credentialed or bulk modes.

One day we thought Redis was just another caching layer we could skip. One week later, our entire system collapsed. Here’s the brutal…

Build abuse-resistant throttling in NestJS that stops bots, respects real humans, and avoids nuking everyone behind the same IP.

Some boxes have one interesting thing. VulnNet: Active had a chain of them. Every step fed directly into the next, and by the end I had a…

Redis, uygulama geliştirirken en çok kullanılan araçlardan biri. Hızlı, kolay kurulur ve Docker ile dakikalar içinde ayağa kalkar. Ama bu…

The popular open-source groupware suite mailcow: dockerized is facing a high-stakes security challenge. A critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the platfo…

Redis releases critical patches for 5 vulnerabilities, including RCE via the RESTORE command (CVSS 7.7). Secure your self-managed Redis instances immediately!

Introduction

And without it, anyone can walk in and trash the place.

A recent report shows persistent P2Pinfect botnet activity inside Google Kubernetes Engine via exposed Redis instances. Learn how to secure your network.

Memory Corruption Vectors in Redis Streams and RedisBloom Even an applied security patch does not invariably seal a legacy vulnerability. A newly published suite of proof-of-concept demonstrations…

TL;DR: A public proof-of-concept now targets CVE-2026-66373, a Redis RCE flaw in the RESTORE command. The double-free bug lets an authenticated attacker corrupt memory and run code. Redis fixed it…

In the first article, we explored why rate limiting is one of the most important security controls protecting modern applications. Now…