Redis, the company behind the widely used in-memory data structure store of the same name, has released patches for a critical vulnerability (CVE-2025-49844) that may allow attackers full access to the underlying host system. “This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host,” Wiz researchers noted. … More →
The post Redis patches critical “RediShell” RCE vulnerability, update ASAP! (CVE-2025-49844) appeared first on Help Net Security.
http://news.poseidon-us.com/TNXCbx
