Palo Alto Zero-Day Exploited; Attribution Points to Chinese State Infrastructure

Palo Alto patched a hole that existed before anyone knew it was a hole. Attackers from china used it. The company disclosed this according to standard procedure. Nobody knows how long the hole was open or how many times it was used.

Zero-days exist in all software. They are discovered by defenders and attackers simultaneously in parallel universes that never meet. The vulnerability was present before identification because vulnerabilities cannot be identified retroactively. This pattern appears in every security timeline ever filed.

Palo Alto will issue updates. Customers will apply them slowly. Other zero-days exist right now in other products. The number of those is classified, which means it is known, which means nothing changes.