PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-1097] IngressNightmare: CVE-2025-1974 - 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX

wiz.io | vulnerability | CVE-2025-1097 | #cloud | #rce | #cloud-security | #kubernetes | #vulnerability | #ingress-nginx | #cve-2025-1974
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research discovered IngressNightmare: four unauthenticated RCE flaws in Kubernetes Ingress NGINX (CVE-2025-1974 et al., CVSS 9.8) exposing all cluster secrets; ~43% of cloud environments affected.
CVE
CVE-2025-1097
Published
Collected

Related coverage

vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
Back