Threat hunting with Sysdig: Uncovering “IngressNightmare”

Sysdig's blog describes the IngressNightmare zero-day in the NGINX Ingress Controller (affecting an estimated ~40% of Kubernetes environments), reports active exploitation enabling remote code execution, and demonstrates how Sysdig used Falco-based runtime detections, threat intelligence feeds, Graph Search, and integrated response/remediation (container isolation/kill and AI-driven patch guidance) to detect, contain, and remediate affected workloads.