CISA warns of critical Palo Alto Networks bug exploited in attacks

CISA warns that attackers are exploiting a critical missing-authentication vulnerability (CVE-2024-5910) in Palo Alto Networks Expedition, which can allow remote admin account takeover and access to secrets; a proof-of-concept and chaining with a command-injection flaw (CVE-2024-9464) enable unauthenticated arbitrary command execution and potential PAN-OS firewall takeover, prompting patches, mitigation guidance, and inclusion in CISA's Known Exploited Vulnerabilities catalog.