22,500 Palo Alto firewalls "possibly vulnerable" to ongoing attacks

CVE-2024-3400 is a critical PAN-OS GlobalProtect command-injection zero-day exploited since at least March 26, 2024 by a state-backed actor (UTA0218) to deploy a custom backdoor named Upstyle; Palo Alto released mitigations and patches between April 14–18, but roughly 22,500 devices remained possibly vulnerable as of April 18 and a public proof-of-concept accelerated broad exploitation and scanning activity.