Patch Now: 'RediShell' Threatens Cloud Via Redis RCE

Wiz Research disclosed a critical, decade-old Redis vulnerability (CVE-2025-49844, “RediShell”) that allows post-auth attackers to send malicious Lua scripts to escape the Lua sandbox via a use-after-free and achieve arbitrary native code execution on Redis hosts. With a CVSS of 10 and an estimated 300,000 exposed instances (60,000 without authentication), the flaw poses a widespread risk to cloud environments; vendors released patches and guidance to patch, restrict network access, require authentication, disable Lua for untrusted users, and monitor for exploitation.