Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Summary: Redis shipped seven security releases on July 23 after researchers published authenticated RCE proof-of-concepts for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, all requiring RESTORE. The chains exploit a Streams shared-NACK double-free and a RedisBloom TDigest out-of-bounds write; Chaofan Shou said on X that Kimi K3 agents found 19 Redis zero-days in about 90 minutes and produced the 8.8.0 exploit in 27 minutes, though those counts and timings remain self-reported.
Bottom line: Redis 6.2.22 and 7.4.9 were the May security updates users were told to install, and by July both needed another update because the shared-NACK ownership guard was missing - so "recently patched" is not the same as fixed, and the exact branch version is what matters.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-25243CVE-2026-25589
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026