9 hours ago
- Many Redis instances are left exposed on the internet without protection, leading to malware infections, especially for crypto mining.
- Incapsula reported that 75% of open Redis servers are infected; attackers exploit misconfigured instances.
- Redis 4.0 introduced 'protected mode' to warn users about exposure, but many VM images disable it, reducing effectiveness.
- Future Redis 6 will feature ACLs to restrict administrative commands by default, aiming to improve security.
- SSL support is also planned for Redis 6, but it will be opt-in.
- Lua sandbox in Redis EVAL may still pose security risks despite efforts to secure it.