Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with wiz (discovery and reporting), and containment measures with released patched versions (6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2), containment measures with advisory published on github, containment measures with public disclosure with mitigation guidance, and remediation measures with apply patches to affected redis versions, remediation measures with restrict eval and evalsha commands via acl, remediation measures with limit lua script execution to trusted identities, remediation measures with avoid exposing redis instances to the internet, remediation measures with enforce strong authentication, and communication strategy with github advisory, communication strategy with public disclosure via media, communication strategy with vendor notifications, and network segmentation with recommended as mitigation, and enhanced monitoring with recommended for redis instances, and third party assistance with wiz research (discovery/reporting), and containment measures with patch deployment (see fixed versions), containment measures with disabling lua scripting via acl restrictions on eval/evalsha commands, containment measures with network segmentation, and remediation measures with enable authentication (default disabled in official container images), remediation measures with disable unnecessary redis commands, remediation measures with run redis as non-root user, remediation measures with activate logging/monitoring, remediation measures with implement network-level access controls, remediation measures with restrict redis access to authorized networks, and communication strategy with public advisory by redis, communication strategy with alert by german bsi, communication strategy with wiz research blog post (technical details withheld temporarily), and network segmentation with recommended, and enhanced monitoring with recommended (redis logging activation)..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Potential: Credentials, Sensitive Data In Redis, Cloud Environment Resources, , Redis Database Contents, Host System Files, Cloud Credentials (E.G., Iam Tokens) and .

Third-Party Assistance: The company involves third-party assistance in incident response through Wiz (discovery and reporting), , Wiz Research (discovery/reporting), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Apply patches to affected Redis versions, Restrict EVAL and EVALSHA commands via ACL, Limit Lua script execution to trusted identities, Avoid exposing Redis instances to the internet, Enforce strong authentication, , Enable authentication (default disabled in official container images), Disable unnecessary Redis commands, Run Redis as non-root user, Activate logging/monitoring, Implement network-level access controls, Restrict Redis access to authorized networks, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by released patched versions (6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2), advisory published on github, public disclosure with mitigation guidance, , patch deployment (see fixed versions), disabling lua scripting via acl restrictions on eval/evalsha commands, network segmentation and .

Key Lessons Learned: The key lessons learned from past incidents are Default configurations in widely used software can introduce long-term risks (13-year-old bug).,Exposing database instances to the internet significantly increases attack surface.,Scripting features (e.g., Lua in Redis) require strict access controls.,Proactive vulnerability discovery (e.g., by Wiz) is critical for open-source projects.Default configurations (e.g., no auth in container images) introduce significant risk,Legacy code (2012 vulnerability) can resurface as critical flaws,Widespread exposure of services (330K instances) amplifies impact,Post-authentication vulnerabilities can be as severe as pre-auth flaws.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Isolate Redis instances with network access controls, Enable authentication for all Redis instances, Disable Lua scripting if not required (via ACLs), Immediately patch Redis to fixed versions (see advisory), Audit cloud environments for exposed Redis instances, Harden Redis deployments (non-root user, command restrictions, logging) and Monitor for exploitation attempts (especially after PoC release).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: GitHub Advisory for CVE-2025-49844, and Source: Wiz Research Report, and Source: Redis Official Announcement, and Source: Wiz Research, and Source: German Federal Office for Information Security (BSI) Alert, and Source: Redis Security Advisory.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Github Advisory, Public Disclosure Via Media, Vendor Notifications, Public Advisory By Redis, Alert By German Bsi and Wiz Research Blog Post (Technical Details Withheld Temporarily).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Users Advised To Patch Immediately And Apply Mitigation Measures, Redis Users Urged To Update, Restrict Lua Script Access, And Secure Instances, , Redis Users/Administrators, Cloud Service Providers, Devops/Sre Teams, Security Researchers and Users advised to patch immediately or disable Lua scripting; hardening guidance provided.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Wiz (Discovery And Reporting), , Recommended For Redis Instances, , Wiz Research (Discovery/Reporting), , Recommended (Redis logging activation).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patches Released To Fix The Memory Corruption Bug., Guidance Provided To Restrict Lua Script Execution., Public Awareness Campaign On Securing Redis Deployments., Recommendations For Network Segmentation And Monitoring., , Code Fixes In Patched Versions, Security Hardening Recommendations, Public Awareness Campaigns (E.G., Bsi Alert), .

Most Recent Incident Detected: The most recent incident detected was on 2025-05-16.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10-03.

Most Recent Incident Resolved: The most recent incident resolved was on 2025-10-03.

Most Significant Data Compromised: The most significant data compromised in an incident were Potential credentials, Sensitive data stored in Redis, Cloud environment resources, , Redis database contents, Host system data, Cloud service credentials (e.g., IAM tokens) and .

Most Significant System Affected: The most significant system affected in an incident was Redis instances with Lua scripting enabledUnderlying host systems and Redis servers (v8.2.1 and earlier with Lua scripting)Underlying host systemsCloud environments using Redis containers.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was wiz (discovery and reporting), , wiz research (discovery/reporting), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Released patched versions (6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2)Advisory published on GitHubPublic disclosure with mitigation guidance and Patch deployment (see fixed versions)Disabling Lua scripting via ACL restrictions on EVAL/EVALSHA commandsNetwork segmentation.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Redis database contents, Cloud environment resources, Sensitive data stored in Redis, Cloud service credentials (e.g., IAM tokens), Host system data and Potential credentials.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Post-authentication vulnerabilities can be as severe as pre-auth flaws.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Isolate Redis instances with network access controls, Restrict EVAL and EVALSHA commands via ACL rules to prevent Lua script execution by untrusted users., Monitor Redis instances for unusual activity, especially Lua script executions., Enable authentication for all Redis instances, Audit Redis data for sensitive information and apply encryption where needed., Segment networks to limit lateral movement if a Redis instance is compromised., Review cloud environments for misconfigured Redis deployments., Disable Lua scripting if not required (via ACLs), Enforce strong authentication (e.g., passwords, TLS) for Redis instances., Immediately patch Redis to fixed versions (see advisory), Immediately patch Redis instances to versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, or 8.2.2., Harden Redis deployments (non-root user, command restrictions, logging), Audit cloud environments for exposed Redis instances, Avoid exposing Redis instances to the internet; use firewalls or private networks. and Monitor for exploitation attempts (especially after PoC release).

Most Recent Source: The most recent source of information about an incident are GitHub Advisory for CVE-2025-49844, Redis Official Announcement, German Federal Office for Information Security (BSI) Alert, Wiz Research Report, Wiz Research and Redis Security Advisory.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Completed (vulnerability disclosed, patches released; no evidence of wild exploitation).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Users advised to patch immediately and apply mitigation measures, Redis users/administrators, Cloud service providers, DevOps/SRE teams, Security researchers, .

Most Recent Customer Advisory: The most recent customer advisory issued were an Redis users urged to update, restrict Lua script access, and secure instances and Users advised to patch immediately or disable Lua scripting; hardening guidance provided.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was 13-year-old use-after-free bug in Redis Lua scripting implementation.Default enabling of Lua scripting without strict access controls.Widespread exposure of Redis instances to the internet (~330,000 instances).Lack of authentication on ~60,000 exposed instances., Use-after-free bug in Lua sandbox (introduced 2012)Default insecure configurations (auth disabled in container images)Widespread internet exposure of Redis instancesLack of input validation for Lua scripts.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patches released to fix the memory corruption bug.Guidance provided to restrict Lua script execution.Public awareness campaign on securing Redis deployments.Recommendations for network segmentation and monitoring., Code fixes in patched versionsSecurity hardening recommendationsPublic awareness campaigns (e.g., BSI alert).