Patch Now: ‘RediShell’ Threatens Cloud Via Redis RCE

A 13-year-old vulnerability in Redis, tracked as CVE-2025-49844 and dubbed RediShell, can allow full remote code execution and post-authentication access to a Redis host, according to Wiz Research. The flaw stems from a use-after-free memory corruption bug and has a CVSS score of 10, the highest severity, with the Redis project publishing a security bulletin and releasing a patched version on 3 October.

Wiz researchers note that an attacker can send a malicious Lua script to escape the Lua sandbox and achieve arbitrary native code execution, after which a reverse shell can be opened for persistent access. The researchers warn that Redis is widely used, with Wiz estimating it in about 75% of cloud environments, and that more than 300,000 Redis instances are exposed, including 60,000 that require no authentication.

They also highlight that 57% of cloud environments install Redis as container images, often with insufficient security hardening, and urge immediate patching of exposed instances. According to Wiz Research, organisations should prioritise those exposed to the Internet and implement mitigations such as authentication via requirepass, network controls, and restricting Lua script execution.