erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: October 3, 2025

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Patch this week: RediShell. Anyone self-hosting Redis with Lua scripting (the default) below the fixed versions, first of all instances that are internet-reachable or have no requirepass/ACLs.
  • npm: 1 critical advisory (flowise). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2025-49844

RediShell: 13-Year-Old Lua Use-After-Free RCE in Redis

Exploitation needs an authenticated session, so properly locked-down Redis can be patched in a normal urgent window; instances reachable without a password are effectively unauthenticated RCE and should be fixed today.

Must act: Anyone self-hosting Redis with Lua scripting (the default) below the fixed versions, first of all instances that are internet-reachable or have no requirepass/ACLs.

Can relax: Redis Cloud users (patched by Redis) and teams whose Redis is private, authenticated, and only used by trusted application code, though they should still upgrade.

  1. Check versions: redis-cli INFO server | grep redis_version (and image tags for containers)
  2. Upgrade to a fixed release for your line; for Redis Software use 7.22.2-20 or later (earlier advisory text wrongly named -12/-14)
  3. If you cannot patch yet, block Lua via ACL, e.g. ACL SETUSER <user> -eval -evalsha (and the script/function commands you do not use)

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 1

Check: npm audit (or: npm ls <package>)