Flaws found in phones, printers, smart devices, AI infrastructure and AI coding agents show the growing attack surface facing Australian organisations
TrendAI™, the global AI security leader from Trend Micro Incorporated ( TYO: 4704 ; TSE: 4704 ), today highlighted the scale of hidden risk in the technology Australians use every day, after ethical hackers uncovered 98 unique zero-day vulnerabilities at the TrendAI™ Zero Day Initiative™ (ZDI) Pwn2Own Ireland competition that awarded over US$1.2 million.
Up from 73 zero-day vulnerabilities at the same event in 2025, the flaws spanned mobile phones, smart devices, wellness devices, printers, messaging apps, AI infrastructure and AI coding agents. These have been disclosed to vendors so they can be fixed before attackers find them.
Mick McCluney, Field CTO, TrendAI™ ANZ: “Finding 98 zero-day vulnerabilities in three days shows how much undiscovered risk sits inside the devices and AI tools Australians use every day. The phone in your pocket, the printer on the office network and the AI coding agent a developer installed last week can form part of an organisation’s attack surface.
“Visibility into these vulnerabilities helps us protect Australian organisations through virtual patching, an average of 115 days ahead of the rest of the industry. As the attack surface grows with AI, zero-day threats will continue to rise, reinforcing the importance of visibility over devices and AI systems connected to your environment, and closing the gap between a flaw being disclosed and patched.”
Dustin Childs, Head of Threat Awareness at TrendAI’s Zero Day Initiative™: “The vulnerabilities discovered at Pwn2Own are sent to vendors so they can patch them quickly. The lasting value of an event like this is what defenders learn. Every exploit chain demonstrated on stage teaches us something new how modern systems break, and those lessons go directly into how we train our own research capability to discover, validate and remediate the one faster. As AI tools and infrastructure continue to become central to business functions, staying ahead of vulnerabilities will be as critical as ever.”
The devices on stage at Pwn2Own are deliberately familiar: phones, printers, smart hubs and wearables. That familiarity is the point. Watching a researcher chain several flaws together to take over a consumer phone makes visible a process that usually happens out of sight. It is the same process, and often the same class of flaw, that applies to the enterprise-grade systems behind ecommerce, banking, critical infrastructure and healthcare in Australia.
The findings come after Australia’s first mandatory security standards for consumer smart devices took effect under the Cyber Security Act 2024. Since 4 March 2026, manufacturers of internet-connected consumer products such as smart devices must avoid universal default passwords, publish how security issues can be reported, and state how long their products will receive security updates.
The disclosures made through TrendAI™ ZDI at Pwn2Own and year-round allow vendors to quickly understand and fix vulnerabilities before cybercriminals exploit them, ultimately benefiting organisations and end users of the impacted software or hardware. TrendAI™ research has shown that vendors are increasingly neglecting to patch software vulnerabilities that are disclosed to them. Through the TrendAI™ ZDI coordinated disclosure process, TrendAI Vision One™ customers are protected an average of 115 days ahead of the rest of the industry.
Highlights from the event included:
Ikotas Labs, Inc. was named Master of Pwn after it chained multiple issues together to successfully exploit the Google Pixel 10 at the very end of the three-day competition.
Ikotas Labs, Inc. was named Master of Pwn after it chained multiple issues together to successfully exploit the Google Pixel 10 at the very end of the three-day competition.
Xint, which placed second in the competition, successfully demonstrated a remote exploit of the Google Pixel 10 through a single bug collision.
Xint, which placed second in the competition, successfully demonstrated a remote exploit of the Google Pixel 10 through a single bug collision.
Interrupt Labs successfully took over the Lexmark CX532adwe printer and played DOOM on its screen.
Interrupt Labs successfully took over the Lexmark CX532adwe printer and played DOOM on its screen.
The Pwn2Own competition is expected in early 2027. For more details, please visit:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
