RediShell: Critical Redis Lua flaw exposes 330k internet servers

Security researchers have disclosed a critical remote code execution vulnerability in Redis, the widely used in memory data store, that could let attackers gain full control of affected servers. The flaw, tracked as CVE2025-49844 and dubbed RediShell by the researchers, was disclosed publicly in early October after patches were issued on October 3. Researchers warn that hundreds of thousands of Redis instances are exposed online and many lack authentication, increasing the urgency for immediate remediation.

Wiz Research said the vulnerability is a use-after-free memory corruption in Redis’s embedded Lua scripting engine that dates back roughly 13 years. An attacker who can submit a Lua script to a vulnerable instance can escape the Lua sandbox and execute arbitrary native code on the host. That capability can let an attacker establish a reverse shell, harvest credentials and tokens, exfiltrate data, install malware or cryptominers, and move laterally across cloud environments.

Wiz’s analysis found about 330,000 Redis instances reachable from the internet, roughly 60,000 of which have no authentication configured. The official Redis container image does not enable authentication...