{"uuid": "8259fb3e-e4d8-4a0b-83a3-03e114518920", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49844", "type": "seen", "source": "https://t.me/pphm_HackerNews/1011", "content": "\ud83d\udea8 A 13-Year-Old Bug Just Shook Redis \u2014 Here\u2019s Why It Matters\n\nCybersecurity researchers have just uncovered a shocking Redis vulnerability that\u2019s been hiding for 13 years! Known as RediShell (CVE-2025-49844), the flaw lets attackers escape Redis\u2019 Lua sandbox and run malicious code directly on the host system\u2014essentially taking full control. What makes it worse is that many Redis servers are still wide open online, with thousands lacking any password protection. An attacker only needs to upload a crafty Lua script to pull off the exploit, leading to stolen data, malware drops, or even full network compromise. Redis has already issued a patch, but experts urge everyone to update immediately, restrict Lua access, secure configurations, and rotate credentials to stay safe.", "creation_timestamp": "2026-07-22T05:00:05.059173Z"}