Palo Alto Zero-Day Exploited in Campaign with Hallmarks of Chinese State Hacking

Palo Alto Networks discovered a zero-day vulnerability in their software. Attackers with apparent ties to chinese state operations had already exploited it. The vulnerability existed in versions before anyone knew to look for it.

Zero-days get found and used. This is the expected sequence. Organizations file vulnerability disclosures after exploitation is confirmed, which means the timeline always shows the exploit first. No one has filed a report explaining why discovery lags use by months or years as standard practice.

Palo Alto will release a patch. Organizations will apply it on their own schedule. The actors involved will move to a different vulnerability that is also already zero. This cycle continues because it is cheaper than prevention.