A single misconfigured Redis instance exposed user sessions for a week.  That was not an accident. It was a predictable chain of small…

Redis patched a Critical (CVSS 10.0) RCE flaw (CVE-2025-49844) in Lua scripting. An authenticated attacker can exploit a Use-After-Free bug to gain code execution.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A critical 10/10 RCE flaw (CVE-2025-49844) has been found in Redis. The flaw, active for 13 years, allows unauthenticated attackers to execute arbitrary code.

A critical Redis vulnerability (CVE-2025–49844) has been disclosed with a CVSS score of 10. That means it’s severe, it’s real, and if…

For years, Redis was that silent piece of infrastructure keeping the digital world running without seeking attention. In architecture…

A Critical (CVSS 10.0) Use-After-Free flaw (CVE-2025-49844) in Redis's Lua parser allows authenticated attackers to achieve Remote Code Execution. Update immediately to v8.2.2.

Doctor Web exposed Android.Backdoor.Baohuo.1.origin, a malware hiding in a Telegram X clone. It uses a Redis database for C2, infects 58K+ devices, and steals crypto wallet info from the clipboard.

Redis, the world’s leading in-memory data platform, has issued an urgent patch addressing a high-severity vulnerability (CVE-2025-62507, CVSSv4 7.7) that could allow remote code execution (RCE) un…

MAD-CAT is a security tool to simulate data corruption attacks against MongoDB, Elasticsearch, Cassandra, and other databases in credentialed or bulk modes.

One day we thought Redis was just another caching layer we could skip. One week later, our entire system collapsed. Here’s the brutal…

Build abuse-resistant throttling in NestJS that stops bots, respects real humans, and avoids nuking everyone behind the same IP.

Some boxes have one interesting thing. VulnNet: Active had a chain of them. Every step fed directly into the next, and by the end I had a…

Redis, uygulama geliştirirken en çok kullanılan araçlardan biri. Hızlı, kolay kurulur ve Docker ile dakikalar içinde ayağa kalkar. Ama bu…

The popular open-source groupware suite mailcow: dockerized is facing a high-stakes security challenge. A critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the platfo…

Redis releases critical patches for 5 vulnerabilities, including RCE via the RESTORE command (CVSS 7.7). Secure your self-managed Redis instances immediately!

Introduction

And without it, anyone can walk in and trash the place.

A recent report shows persistent P2Pinfect botnet activity inside Google Kubernetes Engine via exposed Redis instances. Learn how to secure your network.

Memory Corruption Vectors in Redis Streams and RedisBloom Even an applied security patch does not invariably seal a legacy vulnerability. A newly published suite of proof-of-concept demonstrations…