Redis warns of critical flaw impacting thousands of instances

The Redis security team and Wiz disclosed CVE-2025-49844 (RediShell), a critical Lua use-after-free vulnerability enabling authenticated attackers to escape the Lua sandbox and achieve remote code execution on Redis hosts; patches are available for many releases, and researchers reported roughly 330,000 Internet-exposed instances (about 60,000 without authentication). Administrators are urged to apply updates, disable Lua or enable authentication, run Redis as non-root, and implement network controls to mitigate exploitation and subsequent abuse such as credential theft, cryptomining, lateral movement, and persistent backdoors.