Redis shipped seven emergency security releases on July 23 after researchers published authenticated remote-code-execution proof-of-concept exploits for the popular in-memory data store — with claims that Moonshot AI's newly released Kimi K3 agents autonomously found the flaws and wrote a working exploit in under half an hour. The disclosures affect stock Redis 6.2.22, 7.4.9, 8.6.4 and the freshly cut 8.8.0.
Two RESTORE-based paths, one working RCE
Every published chain requires the RESTORE command; the Streams-based chains additionally need EVAL and XGROUP, and the 8.8.0 chain needs EVAL plus the bundled RedisBloom module. Redis says the underlying memory-safety bugs may lead to remote code execution. The first path is a shared-ownership use-after-free in the Redis Streams pending-entry list: a corrupted RDB object can make two consumers point to the same streamNACK, and removing them frees the same chunk twice.
The second sits in the RedisBloom TDigest RDB loader, which allocated centroid arrays from one serialized value but trusted a separate attacker-controlled capacity when reading them. The published 8.8.0 script uses that mismatch to leak Redis and libc addresses and call system().
Kimi K3's claim: 19 zero-days in 90 minutes
The disclosures come courtesy of Bera Buddies, an "AI Agent Research" outfit, and researcher Chaofan Shou, who said on X that Kimi K3 agents found 19 Redis zero-days in about 90 minutes and produced the Redis 8.8.0 exploit in 27 minutes. Redis's public record confirms the flaws and the fixes, but does not validate the claimed count or the degree of autonomy. It follows an earlier AI-discovered Redis RCE flaw quietly patched in May.
Patch, or restrict RESTORE now
Redis says 6.2.23, 7.2.15 and 7.4.10 fix the Streams shared-NACK use-after-free; 8.2.8, 8.4.5 and 8.6.5 cover both the Streams issue and the RedisBloom/TDigest out-of-bounds write, while 8.8.1 fixes the loader flaws. The 8.6.4 release notes cited PR #15081, but Hacker News's source review found the shipped 8.6.4 tarball still lacked the duplicate-ownership check — that guard only landed in 8.6.5 on July 23. Neither Redis's release notes nor the public PoC repositories reported in-the-wild exploitation as of July 24, and neither CVE has landed in CISA's Known Exploited Vulnerabilities catalog.
Administrators who cannot yet upgrade should revoke the RESTORE command from any account that does not strictly need it and block untrusted network access, cutting off both disclosed paths. The disclosure lands alongside broader AI-in-security news including Moonshot's own K3 GPU-capacity throttling this month and record cybersecurity funding rounds this week.
Reporting based on coverage from The Hacker News, Cybersecurity News and Redis GitHub release notes.