Critical 'IngressNightmare' Vulns Imperil Kubernetes Environments

Kubernetes Ingress NGINX Controller has four critical vulnerabilities (notably CVE-2025-1974) that allow unauthenticated attackers to inject NGINX configuration and, when chained, achieve remote code execution and full cluster takeover; the flaws affect an estimated 6,500 Internet-facing clusters (~41%) and carry a CVSS up to 9.8 — administrators are urged to upgrade to fixed versions (1.12.1, 1.11.5, v1.10.7), restrict admission controller network access, or disable it until patched.