Threat hunting with Sysdig: Uncovering “IngressNightmare”

This Sysdig blog post details the IngressNightmare zero-day (CVE-2025-1974) that impacted an estimated 40% of Kubernetes environments using the NGINX Ingress Controller, describes observed in-the-wild exploitation enabling RCE and shell access, and explains how Sysdig’s runtime detections, threat intelligence feeds, graph search, and automated response/remediation capabilities help detect, contain, and remediate affected workloads.