Operation Lunar Peek: PAN-OS Mgmt Interface Takeover

An internet-exposed PAN-OS firewall management interface was taken over in a single night. An unauthenticated attacker bypassed authentication on the management web interface to gain PAN-OS administrator privileges, chained an authenticated command injection to run commands as root, created a rogue administrator for persistence, and wrote a PHP web shell under the appliance web root that a separate host returned to drive interactively. Reconstruct the full management-plane chain from the firewall and SIEM telemetry and classify the key ATT&CK techniques.