AI Agents Just Found 19 Redis Zero-Days in 90 Minutes

Kimi K3 AI agents discovered 19 Redis zero-day vulnerabilities in under 90 minutes, producing working RCE exploits against four major Redis versions. The findings, published July 24, 2026, triggered seven emergency security releases across Redis 6.2, 7.2, 7.4, 8.2, 8.4, 8.6, and 8.8 branches.

Vulnerability Details

The research team Bera Buddies, self-described as "AI Agent Research," reported that Kimi K3 agents found 19 distinct Redis zero-days in approximately 90 minutes. A subsequent run produced the Redis 8.8.0 exploit chain in 27 minutes. These timings and the zero-day count are self-reported; Redis's public record confirms the vulnerabilities and fixes but does not independently validate the discovery method or speed.

Two exploit chains were published with working proof-of-concept code:

Chain 1: Redis Streams Shared-NACK Use-After-Free (CVE-2026-25243 family)

Affects Redis 6.2.22, 7.4.9, 8.6.4
Corrupt RDB object creates two consumers pointing to the same pending-entry record
Removing both consumers frees the same streamNACK structure twice
Double-free when both consumers are removed
Published script turns double-free into arbitrary memory access, then poisons a database hash function so a crafted GET invokes system()

Chain 2: RedisBloom TDigest RDB Loader Out-of-Bounds Write (CVE-2026-25589 family)

Affects Redis 8.8.0 with RedisBloom module
Loader allocates centroid arrays from serialized compression value
Trusts separate attacker-controlled capacity field for node count
Small real allocation with inflated metadata produces out-of-bounds write
Published script turns write into read/write primitives, leaks Redis and libc addresses, poisons hash function so crafted GET calls system()

Impact Assessment

Both chains require authenticated access with RESTORE command permission. The Streams chain also requires EVAL and XGROUP permissions; the RedisBloom chain requires the RedisBloom module to be loaded.

What's at risk:

Remote code execution as the Redis process user
Full database compromise: data theft, injection, destruction
Lateral movement: Redis often runs with network access to application servers
Persistence: attacker can modify RDB/AOF files for surviving restart

Who needs to act:

Anyone running Redis 6.2.x before 6.2.23
Anyone running Redis 7.2.x before 7.2.15
Anyone running Redis 7.4.x before 7.4.10
Anyone running Redis 8.2.x before 8.2.8
Anyone running Redis 8.4.x before 8.4.5
Anyone running Redis 8.6.x before 8.6.5
Anyone running Redis 8.8.0 (upgrade to 8.8.1)

Check your exact branch version. Redis 6.2.22 and 7.4.9 were the May security releases; both needed another update in July.

Affected Systems

Redis Branch	Vulnerable Versions	Fixed Version	CVE References
6.2	6.2.22 and earlier	6.2.23	CVE-2026-25243
7.2	7.2.14 and earlier	7.2.15	CVE-2026-25243
7.4	7.4.9 and earlier	7.4.10	CVE-2026-25243
8.2	8.2.7 and earlier	8.2.8	CVE-2026-25243, CVE-2026-25589
8.4	8.4.4 and earlier	8.4.5	CVE-2026-25243, CVE-2026-25589
8.6	8.6.4 and earlier	8.6.5	CVE-2026-25243, CVE-2026-25589
8.8	8.8.0	8.8.1	CVE-2026-25589

RedisBloom module versions before 2.8.20 are also affected (CVE-2026-25589).

Mitigation & Patching

Immediate fix: upgrade to the patched version for your branch.

bash

If immediate upgrade is not possible:

Revoke RESTORE from accounts that don't strictly need it:
redis
Block untrusted network access to Redis ports (default 6379)
Restricting RESTORE cuts off both disclosed exploit paths

Verify the fix:

redis

Detection

Network indicators:

Unusual RESTORE commands from application accounts
Repeated EVAL/XGROUP/STREAMS commands in short sequence
RedisBloom module TDigest operations from unexpected clients

Host indicators:

Redis process spawning child processes (system() calls)
Unexpected shared library loads in Redis memory map
Modified RDB/AOF files with corrupted streamNACK structures

Suricata rule for Streams double-free exploit pattern:

alert tcp any any -> $HOME_NET 6379 (msg:"REDIS Streams Shared-NACK RCE Attempt"; flow:to_server,established; content:"RESTORE"; nocase; content:"XGROUP"; nocase; content:"EVAL"; nocase; within:200; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-admin; sid:2026001; rev:1;)

YARA rule for RedisBloom TDigest exploit payload:

rule RedisBloom_TDigest_RCE {
    meta:
        description = "Detects RedisBloom TDigest RDB loader exploit payload"
        author = "Aiyu Blog Automation"
        date = "2026-07-28"
    strings:
        $restore = "RESTORE" nocase
        $tdigest = "TDigest" nocase
        $capacity = "capacity" nocase
        $system = "system" nocase
    condition:
        $restore and $tdigest and $capacity and $system
}

Sigma rule for suspicious Redis CLI activity:

title: Suspicious Redis RESTORE and EVAL Command Sequence
id: 20260728-redis-rce-sequence
status: experimental
description: Detects RESTORE followed by EVAL/XGROUP within short timeframe
logsource:
    category: application
    product: redis
detection:
    selection_restore:
        command: "RESTORE"
    selection_exploit:
        command|contains:
            - "EVAL"
            - "XGROUP"
            - "TDigest"
    timeframe: 10s
    condition: selection_restore and selection_exploit
fields:
    - command
    - user
    - client_ip
level: high

Frequently Asked Questions

Q: Were these vulnerabilities exploited in the wild before disclosure? A: Neither Redis's July 23 release notes nor the public PoC repositories reported in-the-wild exploitation as of July 24, 2026.

Q: Do the May 2026 Redis security releases (6.2.22, 7.4.9) protect against these flaws? A: No. Those releases fixed different issues. The Streams shared-NACK guard was missing from 8.6.4's tagged source and only appears in 8.6.5 (released July 23). Both 6.2.22 and 7.4.9 needed the July updates.

Q: Is there a CVE for the July 2026 Streams shared-NACK flaw? A: As of July 24, NVD still listed only the May records for CVE-2026-25243 and CVE-2026-25589. No separate NVD record existed for the July shared-NACK or TDigest findings. Redis's release notes list no CVE or CVSS score for either new bug class.

Q: Can I mitigate without upgrading by just disabling the RedisBloom module? A: Disabling RedisBloom blocks the TDigest chain (Chain 2) but not the Streams shared-NACK chain (Chain 1), which exists in core Redis. You must also restrict RESTORE.

Q: How did Kimi K3 agents find these vulnerabilities? A: The claimed discovery process (19 zero-days in 90 minutes, 27 minutes for 8.8.0 exploit) is self-reported by the researchers. Redis's public record confirms the flaws and fixes but does not validate the AI autonomy claims or timing.

Key Takeaways

AI-discovered vulnerabilities are here: Whether fully autonomous or human-guided, AI agents are producing working RCE exploits against critical infrastructure software.
Patch verification matters: The May 2026 Redis releases (6.2.22, 7.4.9) did not include the Streams guard against the shared-NACK flaw. Version numbers alone don't guarantee safety—check the exact patch content.
RESTORE is a high-risk command: Both chains require RESTORE. Treat it like a privileged operation: restrict via ACL, audit usage, monitor for anomalies.
Module supply chain risk: The RedisBloom TDigest flaw shows how third-party modules expand attack surface. Audit loaded modules as rigorously as core Redis.
No CVE doesn't mean no risk: The July flaws had no fresh CVE records at disclosure. Track vendor release notes and security mailing lists, not just NVD.

Conclusion

The Kimi K3 Redis zero-day disclosure marks a milestone: AI agents autonomously finding and exploiting multiple zero-days in a widely deployed database. For developers and operators, the lesson is practical: verify your exact Redis branch version, restrict RESTORE via ACL, and monitor for the command sequences these exploits use. The fixes are available—apply them now.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Hello.

Kimi K3 AI Agents Discover 19 Redis Zero-Days in 90 Minutes: RCE Exploits Released