Palo Alto Networks’ firewall bug under attack brings fresh havoc to thousands of companies

Palo Alto Networks urged immediate patching for CVE-2024-3400, a critical unauthenticated remote-code-execution zero-day in PAN-OS used by GlobalProtect firewalls; public proof-of-concept code and reports of active exploitation since late March — including attribution by Volexity to a government-backed actor (UTA0218) and Shadowserver’s estimate of ~156,000 potentially affected devices — raise urgent risk to organizations relying on these firewalls.