[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-KDxl_YCVzWZ5GyrPZDJzezupb9ML88_UWX57dzE264":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9651ce0e-8da6-48e4-94b2-7ffe74a5a2a4","Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own","three-teams-demonstrate-remote-hacks-of-fully-patched-google-pixel-10-at-pwn2own-b0109e","Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner. Trend Micro's Zero","Three research teams successfully demonstrated remote exploits against fully patched Google Pixel 10 devices at Pwn2Own Ireland. While contest rules require undiscovered bugs, at least two of the exploits involved previously known vulnerabilities, termed 'collisions'. Ikotas Labs won the top prize of $300,000 for chaining multiple issues, though their entry was also labeled a collision.","Three teams remotely hacked fully patched Google Pixel 10 phones at Pwn2Own Ireland contest.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fthree-teams-demonstrate-remote-hacks-of.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgqGob0G-EHmqSYe9ZFWu_Pqg2ZivxomC2c4TSsW_k2yx0eZClRf8rgYVhDJTUrrhyzKr8yQr00rjzvVCRc7EsZjELELmKTWVxzLLsvx0DV5Q0rLWGd1eczFcVKTIBweBiuxIpfnB9HnT-1_DPUpxqagt4sXvjLvPiY1bZOz36oJnXV84KoOHVW8ZYY8es\u002Fs1600\u002Fpwn2own.jpg","2026-10-09T08:26:17+00:00","2026-10-09T10:00:24.653258+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Pixel 10","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":19},"Galaxy S26",{"name":26,"type":22},"Samsung",{"name":28,"type":19},"Codex",{"name":30,"type":22},"OpenAI","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,26,30],{"controls":47,"vendors":135},[48,77,106],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":107,"name":108,"problem":109,"products":110},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[136],{"slug":137,"name":21,"logo_path":138,"roles":139},"google","\u002Fvendor-logos\u002Fgoogle.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":155},"fully-patched-pixel-10-hacked-remotely-at-pwn2own-via-chained-exploits","Fully Patched Pixel 10 Hacked Remotely at Pwn2Own via Chained Exploits","Three research teams successfully compromised fully patched Google Pixel 10 devices at Pwn2Own Ireland, with at least two exploits leveraging previously known but unpatched or insufficiently mitigated vulnerabilities — a phenomenon called 'collisions.' This demonstrates that being 'fully patched' does not equate to being fully secure, as vendor patch cycles can lag behind known vulnerability disclosure. Chaining multiple lower-severity bugs into a single high-impact exploit is a common real-world attacker technique that bypasses traditional patch-centric defenses. Organizations relying solely on patch status as their security benchmark are exposed to residual risk from known vulnerabilities that lack available fixes or whose patches are delayed.",[146,147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST Cybersecurity Framework ID.RA-1: Asset vulnerabilities are identified and documented","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","OWASP Mobile Security Testing Guide (MSTG)","ITIL Change Management: Emergency Change procedures for critical patches",{}]