Wiz observes exploitation in the wild of PAN-OS vulnerabilities

Wiz reports active exploitation of PAN-OS vulnerabilities CVE-2024-0012 (authentication bypass) and CVE-2024-9474 (privilege escalation) which, when chained, allow unauthenticated RCE against PAN-OS management interfaces; exploitation increased after a public proof-of-concept and at least ~2,000 instances have been reported compromised. Observed post-exploitation artifacts include simple PHP web shells, Sliver implants (C2 77.221.158.154 / censysinspect.com), XMRig miners, and Linux implants attributed to DaggerFly; the report lists affected PAN-OS version ranges, IOCs (file hashes, paths), and recommends patching, restricting management access, and using Wiz scanning/detection tools.