Kimi K3 AI Discovers Multiple Zero-Day Vulnerabilities in Redis Database

Thehackernews

Kimi K3 AI Discovers Multiple Zero-Day Vulnerabilities in Redis Database

First seen 24 Jul 2026, 10:07 UTC • •73.3

Article Content

1 / 13

Browse articles

ThreatCluster •July 25, 2026 at 09:52 UTC

•Kimi K3 discovered 19 zero-day vulnerabilities in Redis 8.8.0.
•Proof-of-concept exploits were generated in just 27 minutes.
•Redis developers have released updates to patch the identified vulnerabilities.

The Chinese AI model Kimi K3 has reportedly discovered 19 zero-day vulnerabilities in the Redis database, specifically in version 8.8.0. Security researcher Chaofan Shou claims that Kimi K3 generated proof-of-concept exploits in just 27 minutes using a multi-agent approach. The vulnerabilities include critical remote code execution flaws, leading to the release of updated Redis versions to patch these issues. The Redis project confirmed the existence of these vulnerabilities and released several updates on July 24, 2026. The proof-of-concept code has been made publicly available, raising concerns about potential exploitation by malicious actors. The rapid discovery and exploitation capabilities of Kimi K3 mark a significant advancement in AI-assisted vulnerability research. The situation is evolving as the cybersecurity community assesses the implications of this development.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 93d ago How this analysis works

Timeline

2026-07-24

Redis vulnerabilities confirmed

The Redis project confirmed multiple vulnerabilities discovered by Kimi K3 and released updated versions to address them.

2026-07-24

Proof-of-concept code published

Chaofan Shou published a GitHub repository containing proof-of-concept exploits for the vulnerabilities found in Redis.

2026-07-24

Redis updates released

Redis released versions 8.8.1, 8.6.5, and others to patch the vulnerabilities identified by Kimi K3.

More articles in this cluster (12)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Affected Platform (2)

Redis
RedisBloom

Relationships

Zero-day Exploit targets Redis
Zero-day Exploit targets RedisBloom

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…