Kimi K3 AI Agents Discover Multiple Redis Zero-Days and Build RCE Exploit Chains

On July 23, 2026, Redis shipped seven security releases after researchers published authenticated remote code execution (RCE) proof-of-concept (PoC) exploits for stock Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. The vulnerabilities were discovered by Kimi K3 AI agents, developed by Bera Buddies, which reportedly found 19 Redis zero-days in about 90 minutes and produced the Redis 8.8.0 exploit in 27 minutes. However, these claims remain self-reported and are not independently validated by Redis.

The two primary attack paths both require the RESTORE command. The first path exploits a shared-ownership bug in Redis Streams, where a corrupt RDB object can cause a double-free vulnerability, leading to arbitrary memory access and ultimately system() invocation. The second path involves an out-of-bounds write in the RedisBloom TDigest RDB loader, where memory allocation is mismatched with attacker-controlled capacity fields, enabling read/write primitives and code execution.

Redis has released fixed versions: 6.2.23, 7.2.15, and 7.4.10 address the Streams shared-NACK use-after-free; 8.2.8, 8.4.5, and 8.6.5 fix both the Streams issue and RedisBloom/TDigest out-of-bounds writes; 8.8.1 fixes the RedisBloom and TDigest loaders. No new CVE records have been assigned for these specific flaws, and no in-the-wild exploitation has been reported as of July 24, 2026. Users are advised to upgrade to the latest fixed release for their deployed branch and to restrict RESTORE access to only necessary accounts.