Loading story…
JFrog Security published a full exploit chain for a high-severity Redis stack buffer overflow, CVE-2025-62507 (CVSS 8.8), affecting Redis 8.2.0–8.2.2. The flaw is in the new XACKDEL command, where Redis fails to bounds-check the number of message IDs copied into a fixed-size stack array, enabling attacker-controlled overwrite of stack memory and potential control of the return address. The research also highlighted that the official Redis Docker image was compiled without stack canary protections, materially lowering exploitation difficulty and enabling practical remote code execution (RCE) via return-oriented techniques.
Separately, a critical remote command-injection issue was reported in Apache bRPC’s built-in heap profiler service, CVE-2025-60021, affecting all versions prior to 1.15.0. The /pprof/heap endpoint fails to sanitize the extra_options parameter before it is incorporated into command execution for jemalloc profiling, allowing unauthenticated attackers to execute arbitrary system commands with the bRPC process’s privileges when the endpoint is exposed to untrusted networks. Recommended remediation is to upgrade to Apache bRPC 1.15.0+ or otherwise disable/restrict access to the vulnerable profiling endpoint in affected deployments.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Redis resolved the XACKDEL stack overflow vulnerability in version 8.3.2. The issue had exposed vulnerable internet-facing deployments, with cited Shodan data indicating nearly 3,000 exposed servers running affected versions.
JFrog Security Research disclosed a full exploit chain for Redis vulnerability CVE-2025-62507, a stack buffer overflow in the XACKDEL command affecting Redis 8.2.0 through 8.2.2. The researchers showed reliable remote code execution in official Redis Docker containers by leveraging the lack of stack canary protections and building a ROP-based reverse shell exploit.
A critical vulnerability, CVE-2025-60021, was disclosed in Apache bRPC's /pprof/heap endpoint, where the extra_options parameter can be abused to execute arbitrary system commands without authentication. Successful exploitation can lead to remote code execution, lateral movement, data theft, service disruption, and persistence.
Apache bRPC addressed a critical command-injection flaw in its built-in heap profiler service in version 1.15.0, with upstream patch PR #3101 also available as a mitigation. The vulnerability affects all earlier versions when the jemalloc profiling endpoint is exposed to untrusted networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple authenticated remote code execution paths in Redis, showing how users with valid Redis credentials could potentially escalate from datastore access to host-level shell access on stock builds including Redis `6.2.22`, `7.4.9`, `8.6.4`, and `8.8.0`. The reported issues include a stream consumer-group shared-`NACK` double-free linked to the `CVE-2026-25589` incomplete-fix family and a heap overflow in the bundled RedisBloom `TDigest` module affecting Redis `8.8.0`. The attack chains rely on commonly enabled capabilities such as `EVAL`, `RESTORE`, and `XGROUP`, and the report said the double-free was only fully fixed in `8.8.0` while that same release still remained exposed to the RedisBloom bug at disclosure time. At the same time, new offensive-security tooling emerged to help identify exposed Redis deployments. A Rapid7 Metasploit pull request introduced an auxiliary scanner for `CVE-2025-49844` ("RediShell") that checks whether a Redis server is running an unpatched branch and whether Lua `EVAL` is reachable, highlighting how configuration choices such as ACLs can reduce practical exploitability even on vulnerable versions. The combined disclosures underscore the need to patch Redis promptly, restrict dangerous commands, keep Redis off the public internet, rotate credentials, review RedisBloom usage, and monitor for anomalous command activity that could indicate exploitation attempts.
Jul 24, 2026
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as **MongoBleed**—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the `zlib` implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions `8.2.3`, `8.0.17`, `7.0.28`, `6.0.27`, `5.0.32`, and `4.4.30`, while end-of-life branches remain unpatched. A separate advisory disclosed a **critical Redis vulnerability** affecting `8.2.1` and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow **remote arbitrary code execution**, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as `6.2.20`, `7.2.11`, `7.4.6`, `8.0.4`, and `8.2.2`, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
Jun 29, 2026
Redis disclosed five vulnerabilities affecting Redis Cloud, Redis Software, and Redis OSS/CE that could allow authenticated attackers to achieve **remote code execution**, system compromise, data exfiltration, or service disruption. The issues tracked as `CVE-2026-23479`, `CVE-2026-25243`, `CVE-2026-25588`, `CVE-2026-25589`, and `CVE-2026-23631` include an invalid memory access flaw in the `RESTORE` command, a use-after-free bug in the unblock client flow, and a Lua use-after-free condition in certain replica configurations. Public advisories and downstream alerts described four of the bugs as high severity and one as medium severity, with multiple flaws capable of leading to arbitrary code execution. Redis said **Redis Cloud** deployments had already been patched and required no customer action, while self-managed users were told to upgrade to fixed releases across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Government and national CERT notices echoed the vendor guidance and urged administrators to review the advisories and apply updates promptly. Redis also said it had **no evidence of active exploitation** at publication time, but recommended immediate patching and hardening measures such as restricting network exposure, enforcing strong authentication, keeping protected mode enabled where appropriate, and applying least-privilege access controls.
Jun 29, 2026