Company
Trend Micro is a global cybersecurity company providing endpoint, cloud, and network security software and threat intelligence for businesses and consumers.
Three research teams broke into a fully patched Google Pixel 10 remotely at Pwn2Own Ireland on October 8, collecting $562,500 between them. Google has 90 days to ship fixes before the technical details go public, and Pixel owners have no patch or workaround to apply until then.
Reality
Researchers at Pwn2Own Ireland 2026 collected $1,262,000 for exploiting 98 zero-day flaws across seven product categories in three days. Every exploit had to work on current firmware, so owners of those products have to wait for vendor fixes.
Reality
Researchers exploited 45 unique zero-days on day two of Pwn2Own Ireland 2026 for $232,500, hacking Samsung's Galaxy S26 three times. Every target ran its latest firmware, so each win is a working code-execution bug in the build owners run today.
Reality
Pwn2Own Ireland 2026 researchers exploited 32 zero-days on day one for $388,500, including LiteLLM flaws and an OpenAI Codex argument injection. Vendors now have 90 days to ship fixes before ZDI publishes details, and the report describes contest exploits only.
Reality
Flowise fixed a CVSS 9.8 remote-code bug in its CSV Agent with a stricter regex, then saw that filter fail through five more CVEs. It deleted the feature in June, and the patch history is a case against trusting a string filter to vet model-written code.
Reality
GMI Cloud raised $663 million: a $223 million Series B with Nvidia in the round and a $440 million credit facility from ChinaTrust Commercial Bank. Teams that need GPUs in Taiwan, Thailand or Malaysia get a funded local supplier whose expansion rests mostly on borrowed money.
Perspective Coverage
3 publishersReality
GMI Cloud raised $668 million, two-thirds of it through a $445 million credit facility led by CTBC and the rest as a $223 million Series B. Repaying debt on that scale depends on the more than $600 million in contracted annual revenue GMI reports and on how quickly it puts GPUs into production to serve it.
Reality
Securelist says the newest CoolClient deploys a signed kernel-mode driver as a Windows service to hide its process, files and registry keys. It was seen in Pakistan, Mongolia and Myanmar.
Reality
Trend Micro says the loader fires when the module is imported, not when it is installed. That moves the only workable control from install-hook scanning to knowing every name in the resolved tree.
Reality
Google Threat Intelligence and Mandiant put the Brazilian crew's route to Pix and STR at password spraying plus a fake IT support call, which means the controls that bite here are RMM allow-listing and out-of-band verification of the help desk.
Reality
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
Perspective Coverage
5 publishersReality
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
Perspective Coverage
4 publishersReality
Huntress found the same one-megabyte PIF in two customer environments, pulled down by a link that promised a PNG. Everything after it is the 2024 DarkMe chain, down to the rundll32 /sta GUID from that campaign.
Reality
LastPass and Delphos Labs say a single malware-as-a-service kit impersonated at least 40 companies on GitHub, and the kernel driver it delivered was Microsoft-attested and undetected by every engine on VirusTotal.
Reality
The only public count of internet-exposed MCP servers is fourteen months old, so a new open-source scanner fingerprints them by protocol handshake and reports which ones answer a caller holding no credentials.
Reality
Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.
Reality
Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.
Perspective Coverage
3 publishersReality
Sygnia says the actor pivoted from vCenter into ESXi on stolen vpxuser credentials, left backdoors that survive reboots, and terminated vmsyslogd so the hosts stopped writing an audit trail while containment ran.
Reality
A Raxis post catalogues three campaigns that made GitHub the delivery host rather than the hiding place, which is why the 1,300 repositories flagged as open to RepoJacking matter more than the million-device headline above them.
Reality
Broadcom's Threat Hunter Team says the same small team, the same infrastructure and one control panel serve both Chinese state espionage and a crypto-fraud sideline. Actor-type triage does not survive that.
Reality