[redis]

July 25, 2026

• Kimi K3's Redis zero-days force seven security releases. Following last week's report of 32 subagents finding a Redis 0-day in 27 minutes (earlier coverage), Redis shipped seven patches on July 23 after researchers published authenticated RCE PoCs against stock 6.2.22, 7.4.9, 8.6.4 and 8.8.0. All four chains require RESTORE; the Streams chains also need EVAL/XGROUP, and the 8.8.0 chain leans on the bundled RedisBloom module. The Hacker News. · AI & Model Security

in A Default-Config RCE Cracks GitLab, and the PoC Is Already Public

July 24, 2026

• Kimi K3 reportedly discovered and exploited a Redis 8.6.x 0-day with 32 subagents in 27 minutes. Researcher @chetaslua claims a jailbroken Kimi K3 was pointed at "latest 8.6.x redis," told to hunt for BOF/UAF bugs, and produced a working exploit — though the UK AI Safety Institute and NIST's CAISI rate Kimi K3 below leading US frontier models on cyber evals, and Semgrep found its code-security output imprecise. Treat the tweet claim with the appropriate skepticism. · AI & Model Security
• Public Redis RCE PoCs shipped for CVE-2026-25243, a heap double-free/type confusion in the RDB loader via crafted RESTORE payloads (Redis 6.2.x–8.6.3), including a DEBUG-free variant with ASLR on and multi-version PoCs. PoC. · Vulnerabilities & Exploits

in The Week AI Agents Started Doing the Hacking