Redis Critical Code Execution (July 2026): Detection and Hardening for K3 Agent Flaws

On July 23, 2026, Redis released seven critical security updates addressing severe memory corruption vulnerabilities that could lead to authenticated and potentially unauthenticated Remote Code Execution (RCE). These flaws were discovered by researchers using Kimi K3 Agents and impact a wide range of actively deployed versions.

The publication of Proof-of-Concept (PoC) exploits for stock Redis instances significantly increases the risk of active exploitation in the wild. Given Redis's prevalence in caching, session management, and real-time analytics, Security Arsenal urges all administrators to treat this as a critical patching event.

Technical Analysis

Affected Products & Versions:

• Redis 6.2.22
• Redis 7.4.9
• Redis 8.6.4
• Redis 8.8.0

Fixed Versions:

• Redis 6.2.23
• Redis 7.2.15
• Redis 7.4.10

Vulnerability Mechanics: The exploitation chains center on the RESTORE command, which is used to create a key from a serialized value. The researchers identified distinct exploitation paths:

1. Universal Chains: All identified exploitation vectors require the RESTORE command.
2. Streams Chains: Exploitation via Redis Streams requires the usage of EVAL (Lua scripting) and XGROUP (Stream consumer group management).
3. RedisBloom Chain: For version 8.8.0, the chain specifically leverages the EVAL command alongside the bundled RedisBloom module.

While the published PoCs focus on authenticated scenarios, the underlying memory corruption flaws theoretically expose unauthenticated attack vectors. An attacker with valid credentials (or access via a misconfigured instance) can abuse these memory flaws to corrupt the heap and execute arbitrary code, effectively taking over the server and potentially pivoting to the host operating system.

Exploitation Status: PoC code has been publicly released. Active exploitation is expected to rise rapidly given the availability of these exploit chains.

Detection & Response

Detecting exploitation of these specific Redis zero-days requires monitoring for the specific command sequences used in the exploitation chains (RESTORE + EVAL + XGROUP/RedisBloom) and post-exploitation behavior (shell spawning). The following rules and queries are designed to identify suspicious activity on Redis endpoints.

Sigma Rules

---
title: Potential Redis Exploitation via RESTORE Command
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the usage of the RESTORE command in Redis, which is a primary requirement for the July 2026 zero-day exploitation chains. 
references:
  - https://redis.io/topics/security
author: Security Arsenal
date: 2026/07/24
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: redis
  service: redis
detection:
  selection:
   command|contains: 'RESTORE'
  condition: selection
falsepositives:
  - Legitimate administrative backup restoration
level: medium
---
title: Redis Server Spawning Shell Process
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the redis-server process spawning a shell (bash/sh), which may indicate successful RCE via the memory corruption flaws.
author: Security Arsenal
date: 2026/07/24
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/redis-server'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
  condition: selection
falsepositives:
  - Legitimate administrative scripts invoked by Redis (rare)
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for RESTORE command usage in Syslog/CEF logs
Syslog
| where ProcessName contains "redis" or SyslogMessage contains "redis"
| where SyslogMessage contains "RESTORE"
| project TimeGenerated, Computer, SourceIP, SyslogMessage
| extend timestamp = TimeGenerated
---
// Hunt for Redis parent process spawning shells (Linux)
DeviceProcessEvents
| where InitiatingProcessFileName =~ "redis-server"
| where FileName in~ ("bash", "sh", "dash", "zsh")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, CommandLine

Velociraptor VQL

-- Hunt for Redis processes spawning unexpected child shells
SELECT Pid, Name, CommandLine, Exe, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "redis-server"
  AND Name =~ "(bash|sh|dash|zsh)"
---
-- Scan for Redis configuration to check if RESTORE is enabled
SELECT FullPath, Mtime, Size
FROM glob(globs="/etc/redis/redis.conf")
---
-- Identify running Redis server versions
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Name =~ "redis-server"

Remediation Script

#!/bin/bash
# Remediation script for Redis July 2026 Zero-Days
# Checks version and advises on disabling dangerous commands

echo "[+] Checking Redis version..."
redis-cli --version

echo "[+] Checking for recent Redis log entries containing RESTORE..."
# Adjust log path as necessary (common: /var/log/redis/redis-server.log)
if [ -f "/var/log/redis/redis-server.log" ]; then
    grep "RESTORE" /var/log/redis/redis-server.log | tail -20
else
    echo "Log file not found at /var/log/redis/redis-server.log"
fi

echo "[+] Mitigation Recommendation: Disable RESTORE command."
echo "Add the following line to your redis.conf file (usually /etc/redis/redis.conf):"
echo "rename-command RESTORE """

echo "[+] Ensure Redis is bound to loopback or trusted interfaces only."
echo "Check 'bind' directive in redis.conf."

echo "[ACTION REQUIRED] Please update Redis to one of the following patched versions:"
echo "- Redis 6.2.23+"
echo "- Redis 7.2.15+"
echo "- Redis 7.4.10+"

Remediation

1. Patch Immediately: Upgrade to the latest patched releases. Depending on your branch, update to:

   • Redis 6.2.23
   • Redis 7.2.15
   • Redis 7.4.10
   • Note: Check your vendor repositories for the updated packages (e.g., apt update && apt upgrade redis-server).

2. Disable Dangerous Commands: As an immediate interim measure or general hardening practice, disable commands that are not strictly required for business logic. Add the following to your redis.conf:

   rename-command RESTORE "" rename-command EVAL "" rename-command MODULE ""

   After renaming, restart the Redis service (systemctl restart redis).

3. Network Segmentation: Ensure Redis instances are not exposed directly to the public internet. Bind Redis to localhost (127.0.0.1) or private interface IPs only using the bind directive in redis.conf.

4. Authentication Enforcement: Ensure requirepass is set in redis.conf with a strong, unique password. Do not rely on the default empty authentication.

5. Official Vendor Advisory: Review the official Redis security release notes for July 23, 2026, for detailed technical changes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub