KubeCon + CloudNativeCon India 2026

Modern frameworks help teams move fast, but a single vulnerability can quickly escalate into a serious security incident.

In this talk, we simulate a real-world attack scenario where a publicly disclosed RCE vulnerability in Next.js is exploited to deploy crypto-mining workloads inside a Kubernetes cluster. We demonstrate how an application-level vulnerability can quickly escalate into a cluster-wide threat - and how to prevent it before it does.

We’ll break down how such an attack unfolds, the runtime indicators that can expose it, and why patching the application alone isn’t enough.

We’ll then demonstrate how to stop this class of attack using Falco for runtime threat detection and Kyverno for policy enforcement - detecting malicious activity, blocking misuse, and limiting blast radius.

Finally, we’ll share Kubernetes security best practices including resource limits, workload isolation, security policies, and improved runtime visibility to help teams better secure their clusters.