Light

Episode #1047 Quiz

RediShell's CVSS 10.0
Date: 2025-10-14 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1047 reveals RediShell, a critical CVSS 10.0 remote code execution vulnerability in Redis affecting 330,000 exposed servers worldwide. It exploits a 13-year-old Use-After-Free bug in Redis's Lua interpreter, allowing attackers to escape the sandbox and execute arbitrary host code post-authentication, urging immediate patching to prevent cloud environment compromises.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific technical flaw underlies the 'RediShell' vulnerability discovered in Redis servers, and why does it result in a CVSS score of 10.0?

Question 1

What specific technical flaw underlies the 'RediShell' vulnerability discovered in Redis servers, and why does it result in a CVSS score of 10.0?

Buffer overflow in Redis's network stack allowing denial-of-service attacks but no remote code execution. SQL injection vulnerability in Redis's key-value store leading to unauthorized database queries and data leakage. Cross-site scripting vulnerability in Redis web interface that permits credential theft through malicious scripts. Use-After-Free memory corruption in Redis's Lua interpreter that allows escaping the sandbox for native code execution on the host, leading to full system compromise.

Question 2: According to the episode, what critical security practice is repeatedly violated by many Redis deployments, increasing their risk of exploitation?

Question 2

According to the episode, what critical security practice is repeatedly violated by many Redis deployments, increasing their risk of exploitation?

Frequent use of hardcoded Redis credentials within application codebases publicly shared. Running Redis on deprecated hardware lacking necessary CPU instructions for security. Exposing Redis instances directly to the public Internet, often without authentication configured. Use of outdated TLS versions causing encrypted connections to be easily broken.

Question 3: What limitation in Microsoft's Internet Explorer (IE) Mode within Edge has led them to change its accessibility to users?

Question 3

What limitation in Microsoft's Internet Explorer (IE) Mode within Edge has led them to change its accessibility to users?

IE Mode no longer supports essential legacy ActiveX controls required by government sites. IE Mode is disabled by default because it cannot render complex SVG graphics properly, making websites unusable. IE Mode caused frequent crashes on Edge due to incompatibility with modern HTML5 standards. IE Mode’s underlying Chakra JavaScript engine contains unpatched zero-day vulnerabilities exploited to take over user machines.

Question 4: What are the key requirements imposed by the Texas Senate Bill SB2420 on app stores and apps regarding minor users?

Question 4

What are the key requirements imposed by the Texas Senate Bill SB2420 on app stores and apps regarding minor users?

App stores are required to ban all users under 18 from downloading any apps, and developers must disable in-app purchases entirely for minors. App stores must only accept self-declared age statements from users with no further verification, and developers have no obligations regarding age ratings. App stores must use a 'commercially reasonable method' to verify users' ages, obtain verifiable parental consent per transaction for minors under 18, and developers must assign age ratings consistent with the law's categories. Developers must implement biometric age verification in all apps, and app stores need not be involved in age verification or parental consent.

Question 5: What operational risks do the attack techniques used by Scattered LAPSUS$ Hunters to breach Salesforce customers highlight about enterprise API usage?

Question 5

What operational risks do the attack techniques used by Scattered LAPSUS$ Hunters to breach Salesforce customers highlight about enterprise API usage?

Enterprises that disable API access for third parties suffer greater data breaches due to manual error-prone processes. The breach was limited to publicly available API endpoints and did not involve compromised internal credentials or third-party accounts. Compromised third-party accounts can exploit integrated APIs to access and exfiltrate large volumes of sensitive customer data deep within enterprise systems. Encryption of data within APIs eliminates exposure, so breaches only occur at the user interface, not through APIs.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.