Critical Redis Patch Released for Use-After-Free Flaw

Conceptual diagram illustrating an AKS network topology with two VNets, four subnets, both Application Gateway and NGINX for ingress, Azure Firewall for egress, and connections to other Azure services/on-premises networks.

something to put on your radar is the newly disclosed RediShell (CVE-2025-49844) vulnerability in Redis,which has been assigned a CVSS score of 10.0. Discovered by the folks at Wiz https://lnkd.in/gMp_vx-n. - Approximately 330,000 Redis instances are exposed to the internet at the time of this blog post - About 60,000 instances have no authentication configured   - 57% of cloud environments install Redis as container images, many without proper security hardening Redis released a patch for this 13-year-old vulnerability on October 3rd - https://lnkd.in/ghZUNY-t There are conflicting reports on whether this has been actively exploited yet, but patching is highly recommended Redis (REmote DIctionary Server) is an open source, in-memory, NoSQL key/value store that is used primarily as an application cache or quick-response database. Redis stores data in memory, rather than on a disk or solid-state drive (SSD), which helps deliver unparalleled speed, reliability, and performance.

A critical OpenShift AI vulnerability allows attackers to escalate from a standard Jupyter notebook to full cluster admin compromising secrets, workloads, and the entire cluster. Runtime security is the only true safety net. AccuKnox enforces Zero Trust policies at runtime, blocking unauthorized access to service account tokens, preventing malicious process execution, and enforcing least-privilege principles. With AccuKnox: - Stop token exfiltration at the kernel level - Harden notebooks against untrusted processes - Enforce Zero Trust across cloud, hybrid, and edge workloads - Maintain clear audit logs for compliance Read the full blog: https://lnkd.in/dmYNdZ-t

The outage that shook the dev world! On October 20, 2025, Docker services faced a full scale collapse when the AWS US East 1 region went down, leaving millions of containers frozen. At BlueVPS, we have already built the defense: multi region backups, resilient caching layers, and infrastructure that keeps running even when the cloud decides to nap. Do not let your business get stuck in limbo. Secure true 24/7 availability, even when the global cloud ecosystem fails. #BlueVPS #DevOps #CloudComputing #Docker #AWS #HighAvailability #Infrastructure #CyberSecurity #ITSupport #BusinessContinuity

Patch Now: 'RediShell' Threatens Cloud Via Redis RCEElizabeth Montalbano, Contributing WriterA critical 13-year-old vulnerability with a CVSS score of 10 in the Redis data storage service poses a significant security risk, enabling full host takeover. Currently, over 300,000 instances may be exposed.https://https://lnkd.in/dHWD6n2m

If you're still hardcoding secrets in 2025, 𝐘𝐨𝐮'𝐫𝐞 𝐧𝐨𝐭 𝐫𝐞𝐚𝐝𝐲 𝐞𝐧𝐨𝐮𝐠𝐡 𝐭𝐨 𝐛𝐞 𝐚 𝐃𝐞𝐯𝐎𝐩𝐬 𝐄𝐧𝐠𝐢𝐧𝐞𝐞𝐫 With several options available, from AWS Secrets Manager, GitHub Secrets, HashiCorp Vault and even OIDC, There simply isn't an excuse to not be storing your secrets securely. Unless, of course, You don't mind losing your Azure account as well as 6 months' pay. #devsecops #security #devops

A Cascade of Failures: A Breakdown of the Massive AWS Outage The problem started with misconfigured DNS, but soon infected EC2 launches as well, bringing hiccups to many of the largest internet services. Somewhere tonight in northern Virginia, a group of AWS administrators are probably enjoying a beverage after a very long day of troubleshooting. Amazon Web Services suffered a cascade of failures Monday across its US-EAST-1 Region, causing multiple outages across a dizzying array of cloud services, including AWS Lambda, Amazon API Gateway, Amazon Appflow, Amazon Aurora DSQL Service and others. As it is all too often the case, the culprit was DNS misconfiguration. Go figure. Of AWS’ 15 regions worldwide, US-EAST-1 is probably the largest, with clusters of data centers spread across Loudoun, Prince William, and Fairfax counties. And judging from today’s outage, many of today’s largest businesses have at least a footprint in the region. https://lnkd.in/ebJM6SKj Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

⛈️ Storm clouds are brewing: there's a CVSS 10.0 CVE in Redis, the popular in-memory and cloud database provider. CVE-2025-49844 opens up a vector for remote code execution attacks and leaves teams that are unable to update to the latest Redis version at risk of attacks or compliance fines. Our latest blog dives into this vulnerability, the fix, and why a new approach to open source remediation is needed. Check out our preview, then read the full story to see how our one-click patches for open source software let you stand tall against these vulnerabilities. #Redis #OpenSource #AppSec #DevOps

🚨 Critical CVE Alert: CVE-2025-49844 in Redis 🚨 A newly disclosed vulnerability (CVSS 10.0) in Redis could let attackers remotely run code — putting business-critical systems at serious risk. All versions with Lua scripting enabled are affected, so if Redis is part of your environment, it’s time to act. ⚠️ 💡 What you can do: ✅ Update to the latest patched version as soon as possible. ✅ If patching isn’t an option right now, use ACLs to block EVAL and EVALSHA commands as a temporary workaround. 🛡️ With Tanium Guardian, you can quickly spot vulnerable endpoints and see where Redis is running across your environment. Pair it with Tanium Cloud Workloads to discover affected containers and Tanium Enforce to block risky deployments before they cause harm. This one’s rated CVSS 10.0 for a reason — don’t wait to secure your systems. ⏱️ Learn more: https://bit.ly/3IBiiqV

Major security alert! A critical Redis vulnerability (CVE-2025-49844, AKA RediShell) allows remote code execution without authentication. This could let attackers fully compromise affected servers. It dates back 13 years (!!) and is present in 75% of cloud environments. Advice is to update to Redis 8.2.2 immediately, restrict public access, and disable Lua if not needed. https://lnkd.in/dbQXPUee