Skip to main content

Redis Warns of Critical Flaw Impacting Thousands of Instances

2 months 3 weeks ago
An anonymous reader quotes a report from BleepingComputer: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).

Read more of this story at Slashdot.

BeauHD

Apple Hardware Head John Ternus Top Pick To Succeed Tim Cook As CEO

2 months 3 weeks ago
Bloomberg reports (paywalled) that Apple's hardware chief John Ternus is the frontrunner to replace Tim Cook as CEO, as Cook nears retirement and prepares to transition into a board chairman role. The Economic Times reports: Cook is turning 65 next month. Chief operating officer John Williams -- once heir apparent -- has handed over the reins of day-to-day operations to Sabih Khan and is on his way out. Even as Cook steps down as CEO, he will stay involved in some capacity, likely as board chairman. [...] While Khan and Apple's retail chief Deirdre O'Brien can run daily operations, Ternus remains the leading contender for the corner office after Cook, Gurman said. Firstly, he is 50 years old -- the same as Cook when he became CEO -- giving him over a decade to hold the office, he noted. Secondly, Apple needs a technologist instead of a sales person at the helm, considering the company's ambitions, Gurman wrote in the newsletter. While the Cupertino tech giant has managed to expand its homegrown line of chipsets, and the recently launched iPhone 17 lineup is drawing in customers, the company has struggled to find success in categories such as mixed reality, generative artificial intelligence (AI), smart homes and autonomous driving. Ternus was in the spotlight during Apple's annual hardware event in September, which saw the launch of the iPhone 17 Air, the first major design overhaul for the smartphone family in a long time. Over the years, he has gained more responsibilities under Cook, taking calls on product roadmaps, features and strategies, overseeing matters beyond the traditional scope of a hardware engineering chief, Gurman said.

Read more of this story at Slashdot.

BeauHD