Merck on Thursday topped third-quarter estimates and hiked its adjusted profit outlook, as its immunotherapy Keytruda, including a newer injectable form of the drug, showed stronger-than-expected sales.
The pharmaceutical giant now expects adjusted earnings to be between $2.77 and $2.82 per share. That adjusted profit outlook is up from a previous range of $2.66 to $2.76 per share. The guidance now includes a one-time charge of $400 million, or 12 cents per share, related to its licensing agreement with the Chinese cancer drugmaker SciBrunch.
Merck also narrowed the low end of its 2026 revenue guidance, now expecting sales between $66.8 billion and $67.3 billion. That compares to a previous outlook of $66.3 billion to $67.3 billion.
The company has been on a deal spree as it races to offset generic competition for Keytruda after key patents begin expiring in 2028.
Merck is also positioning the new form of the drug, Keytruda Qlex, as a cornerstone of its growth strategy. The goal is to transition patients from the original intravenous version to Qlex, considered a more convenient under-the-skin injection. This strategy allows the company to defend its market share and sustain Keytruda’s blockbuster sales beyond the original version’s loss of exclusivity.
Keytruda raked in $8.60 billion in sales for the quarter, beating the $7.73 billion that analysts were expecting, according to StreetAccount. That includes $830 million in sales for Qlex – the highest seen in a quarter since it launched in 2025.
Analysts were expecting $649 million in sales, StreetAccount estimates said. The blowout quarter for the shot suggests it could soon eventually be a multibillion-dollar product annually.
Here’s what Merck reported for the third quarter compared with what Wall Street was expecting, based on a survey of analysts by LSEG:
Earnings per share: $2.49 adjusted vs. $2.08 expected
Revenue: $18.09 billion vs. $17.31 billion expected
The company posted a net income of $5.07 billion, or $2.04 per share, for the quarter. That compares with net income of $5.79 billion, or $2.32 per share, for the year-earlier period.
Excluding acquisition and restructuring costs, Merck posted earnings of $2.49 per share for the third quarter.
Merck raked in $18.09 billion in revenue for the quarter, up 5% from the same period a year earlier.
Beyond Keytruda, Merck’s newer products also showed strong growth.
Winrevair, which is used to treat a rare, deadly lung condition, generated $694 million in sales for the quarter, up 93% from the same period a year earlier. Analysts were expecting sales of $645 million.
Meanwhile, the Gardasil vaccine, which prevents cancers from HPV, a very common sexually transmitted infection, drew about $2 billion in sales due to higher demand in the U.S. That tops the $1.76 billion in sales that analysts were expecting.
That strong revenue comes after Merck last year grappled with elevated Gardasil inventory and weak demand for the vaccine in China.
Meanwhile, Merck’s animal health business posted $1.68 billion in sales for the third quarter, which came in slightly below analysts’ estimates.

Federal regulators announced Wednesday that they are examining whether major airlines, ride-hailing companies, delivery services and retailers are using personal data to charge different customers different prices for the same products and services or determine how much gig workers are paid.
The Federal Trade Commission (FTC) said it launched an inquiry into nine companies, ordering them to provide information about how they use consumers’ and workers’ personal data to set prices and compensation.
The orders were sent to Delta Air Lines, United Airlines, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart, according to the FTC.
The agency said it is seeking information to assess whether prices for airline tickets, rides, food deliveries and other products or services vary from person to person.
DOLLAR GENERAL SUED BY FTC AND 20 STATES, ACCUSED OF OVERCHARGING CUSTOMERS
Federal regulators will then examine whether factors such as loyalty programs and the analysis of personal data by superintelligence algorithms influence consumer pricing and worker compensation.
“We intend to scrutinize the opaque methodology that some companies in these industries may be using to determine how much consumers pay or how much gig workers are paid for the same product or service,” FTC Chairman Andrew Ferguson said in a statement.
“Consumers deserve to know whether companies use their web surfing habits or other personal data to estimate the highest price they can charge each consumer,” Ferguson continued.
Ferguson said workers “deserve to know if their compensation is affected by how companies use their personal data.”
AMERICAN AIRLINES SAYS AIRFARES COULD STAY ELEVATED EVEN IF FUEL PRICES DROP
In its news release announcing the inquiry, the FTC noted that ride-hailing and food-delivery companies may offer workers varying compensation based on “opaque formulas.”
These companies, the FTC said, “may engage in personalized compensation based on their drivers’ personal data, such as their phone usage or acceptance history for past offers.”
A spokesperson for Instacart told FOX Business that the online grocery marketplace “does not and will not engage in surveillance pricing.”
“We do not use personal information to set prices, and we never will,” the spokesperson said.
WALMART ROLLS OUT NEW BUNDLE COMBINING WALMART+, SAM’S CLUB PLUS
“We appreciate the FTC’s focus on this practice, we are committed to transparency and improving affordability for customers, and we will continue engaging with policymakers and regulators to ensure they understand how pricing on our platform works.”
JetBlue told FOX Business that it “does not use personal information or web browsing history to set individual pricing.”
“Fares are determined by demand and seat availability, and all customers have access to the same fares on jetblue.com and our mobile app,” the airline added.
Delta also denied using personal data to individually price fares, saying it has never used, tested or planned to use a fare product that targets customers with individualized offers based on personal data.
FOX Business has reached out to United, Lyft, Uber, DoorDash, Target and Walmart for comment.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
The FTC said companies that fail to provide the requested information could face legal action to compel compliance. Each company has 45 days from the date it receives the order to respond.

Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces.
“Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the network security company said in an update to its advisory.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The development comes days after Israeli cybersecurity company Dream said it observed a suspected China-nexus threat actor weaponizing the flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across the U.S., Japan, Taiwan, and South Korea.
Among those were three systems belonging to a U.S. government-affiliated environment.
“The affected devices run specific versions of a large vendor’s firewall software,” Dream noted. “The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.”
Although Dream did not disclose the name of the affected firewall vendor, the timing of the advisory, combined with the fact that other network security companies have not reported malicious exploitation against their products, suggests that these events may be related.
The Hacker News has contacted both Dream and Palo Alto Networks for comment, and we will update the story if we hear back.
The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by October 31, 2026.
“This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root,” CISA said.
Palo Alto Networks has also noted that no special configuration is required to be affected by this issue, adding the risk is highest on PAN-OS when access to the management interface is allowed from external IP addresses on the internet.
“This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service,” it said. “It affects the dataplane interface only if a management profile is attached to it.”
The following versions of PAN-OS are impacted by PHP2Shell –
PAN-OS 12.2
= 12.2.4-h1)
PAN-OS 12.1
= 12.1.4-h13) (ETA: 10/29)
= 12.1.7-h11)
= 12.1.10-h3) (ETA: 10/30)
PAN-OS 11.2
= 11.2.4-h23) (ETA: 10/30)
= 11.2.7-h23)
= 11.2.10-h16)
= 11.2.13-h4)
= 11.2.16-h1)
PAN-OS 11.1
= 11.1.4-h38)
= 11.1.6-h40)
= 11.1.7-h12) (ETA: 10/30)
= 11.1.10-h36)
= 11.1.13-h16)
= 11.1.16-h4)
PAN-OS 10.2
= 10.2.7-h39) (ETA: 10/30)
= 10.2.10-h42) (ETA: 10/29)
= 10.2.13-h27)
= 10.2.16-h12)
= 10.2.18-h13)
For PAN-OS versions where fix versions are not yet available, Palo Alto Networks has recommended the following mitigations –
Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.
Replace the Certificate for Inbound Traffic Management.
Decrypt inbound traffic to the management interface so the firewall can inspect it.
Enable threat prevention on the inbound traffic to management services.
“Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later versions received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on October 20,” it said.
“The security risk posed by this issue on PAN-OS and Panorama is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.”

The US state of Utah has announced criminal charges against popular prediction market Kalshi and its two cofounders, accusing the platform and its executives of illegally promoting online gambling.
Utah Attorney General Derek Brown filed the charges against Kalshi, chief executive officer Tarek Mansour and chief operating officer Luana Lopes Lara on Wednesday, a day after US President Donald Trump’s administration sued the state to block its civil enforcement actions against the platform.
Recommended Stories
list of 4 items
list 1 of 4Israelis rally for Jewish-Arab government after election gains
list 2 of 4Riot police deployed in Madrid as protests erupt over deadly train crash
list 3 of 4Bolsonaro in Miami: I am the ‘true president-elect’
list 4 of 4Serbians storm TV studio as pro-Vucic media faces reckoning
end of list
According to the criminal complaint filed in a Salt Lake City court, Kalshi facilitated an undercover law enforcement officer’s wagers on sports events, including games in the NFL.
The charges come after a federal judge in August ruled that Utah was entitled to enforce its stringent anti-gambling laws against online prediction markets, following a legal bid by Kalshi to block enforcement of the law.
The criminal complaint accuses the defendants of 12 counts of online gambling promotion, one count of general gambling promotion and one count of pattern of unlawful activity.
Kalshi and Brown’s office did not immediately respond to requests for comment.
Utah has some of the strictest prohibitions against gambling in the US, with its state constitution explicitly barring lawmakers from legalising the activity.
The charges mark an escalation in a showdown between US states and the Trump administration over the regulation of prediction markets.
On Tuesday, the Commodity Futures Trading Commission filed a lawsuit seeking to block Utah’s enforcement actions against prediction markets, arguing that the platforms fall under federal jurisdiction.
The regulator announced the move after Utah last week filed a civil lawsuit accusing Kalshi of facilitating betting on sports, elections, politics and other outcomes in violation of anti-gambling laws.
Dozens of US states, led by both Republican and Democratic administrations, have argued that the Commodity Futures Trading Commission does not have the authority to regulate prediction markets.
Last month, the state of New Jersey asked the US Supreme Court to rule on whether state or federal authorities have jurisdiction over sports betting on prediction market platforms.

A Texas Roadhouse customer sparked a viral stir after claiming he was given the wrong cut of meat at the steakhouse chain.
Kenneth Card posted a video to TikTok on Oct. 5, claiming he was served a sirloin steak instead of a filet mignon he ordered on three consecutive trips to the restaurant’s Forsyth, Illinois, location.
An eight-ounce sirloin costs just under $20, about $10 less than an eight-ounce filet, according to the location’s menu.
Card told USA TODAY in an interview that he sent the first incorrect steak back and received the correct one as a replacement. He said he accepted and ate the second incorrect steak. When he was served the incorrect steak the third time, Card said he spoke with a manager and took the replacement filet to go.
“When I go into a place, and I order a $30 steak, I expect to eat a $30 steak,” Card said.
The video has since garnered over 34,000 views on TikTok, with commenters claiming similar experiences at other Texas Roadhouse locations. Card told USA TODAY that he no longer patronizes the restaurant and said he made the video to warn potential customers that they may not get “what they are paying for.”
“In this time of everything going on, with gas prices, when I’m going out to eat a decent meal, and you get served some junk, I mean, it just didn’t sit well with me,” Card said.
Texas Roadhouse responds
Texas Roadhouse opened its first restaurant in Indiana in 1993 and now has more than 700 locations across 49 states, according to the chain. Its menu focuses on steaks and other American fare.
In a statement to USA TODAY, Texas Roadhouse acknowledged the error that sparked Card’s video as part of an “extensive investigation.” The chain said that repeated errors would be “nearly impossible,” citing the restaurant’s “quality check” processes.
The chain also said that the investigation found no other customer complaints about incorrect steaks being served at its Forsyth location.
“One of our core values is integrity, and while we are disappointed that this guest received the sirloin in error, this is not something that is an ongoing issue,” the statement added.
Card said he had not experienced issues during the nearly three and a half years as a regular restaurant customer before the first incorrect steak.
He added that he has not been contacted by Texas Roadhouse and does not “want anything” from the company.