CuraSec

tag: Redis · 2 items

Plan TeamPCP Threat Actor Linked to Redis Attacks and Supply Chain Campaign
2026-08-07 · The Hacker News · source ↗ #threat-actor#supply-chain#redis
  • Engineer — Learn: The supply chain angle is worth understanding for build pipeline threat modeling, but no specific packages, IOCs, or patching actions are identified in the summary — audit CI/CD pipelines and artifact registries for signs of TeamPCP TTPs once full reporting surfaces.
  • SOC/IR — Plan: Build or tune detections for Redis-targeting behaviors and review historical logs back to 2020 for overlapping infrastructure indicators; watch for the full IOC list from this report to enable a retroactive hunt.
  • Leader — Learn: A supply chain threat actor with multi-year persistence is worth tracking for risk register context, but no specific vendor compromise or board-level event is identified here yet.
Act archived Redis Patches Seven RCE Flaws After AI Agent Finds Zero-Days with Public PoC
2026-07-24 · The Hacker News · source ↗ #redis#rce#vulnerability
  • Engineer — Act: Public authenticated-RCE PoCs exist for Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0; upgrade to Redis 6.2.23, 7.2.15, or 7.4.10 immediately, and audit whether RESTORE, EVAL, or XGROUP are accessible to untrusted clients in your environment.
  • SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but public PoCs accelerate that timeline; build detections for anomalous Redis command sequences involving RESTORE combined with EVAL or XGROUP, and baseline normal Redis command usage now so deviations surface quickly.
  • Leader — Plan: Redis is pervasive in enterprise stacks; confirm all internal deployments and any SaaS vendors running Redis are targeting the patched versions (6.2.23/7.2.15/7.4.10), and track remediation completion — the authenticated-only attack surface limits immediate board escalation but warrants this-quarter tracking.