Pwn2Own Ireland 2026 Delivers Record $1.26M in Zero-Day Rewards
The Pwn2Own Ireland 2026 hacking contest concluded on October 9, 2026, with security researchers receiving a total of $1,262,000 in cash rewards for demonstrating 98 previously unknown zero-day vulnerabilities. Organized by Trend Micro's Zero Day Initiative (ZDI), the three-day event saw 29 research teams target products across seven categories, including mobile phones, AI infrastructure, AI coding applications, messaging apps, smart home devices, printers, and a newly introduced wellness healthcare devices category.
Ikotas Labs Claims Victory with $361,000 and 42.5 Master of Pwn Points
Ikotas Labs emerged as the overall winner of Pwn2Own Ireland 2026, earning $361,000 and accumulating 42.5 Master of Pwn points over the three-day competition. Their winning exploits included successful compromises of the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database. On the third day of the contest, Ikotas Labs secured the competition's highest single reward of $300,000 by chaining multiple zero-day flaws to achieve remote code execution on the Google Pixel 10.
Xint and Team ZyGoat Take Second and Third Place
Xint finished in second place with $240,000 in prize money and 27.5 Master of Pwn points, while Team ZyGoat claimed third with $125,000 in awards and an identical 27.5 Master of Pwn points score. Both teams demonstrated significant technical prowess across multiple device categories throughout the event.
Day-by-Day Breakdown of Exploits and Earnings
On the first day of Pwn2Own Ireland 2026, Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security successfully demonstrated exploits against the Samsung Galaxy S26 flagship device. Although the vendor had prior knowledge of some of the exploited bugs, the demonstrations contributed to a first-day total of $388,500 in rewards for 32 zero-day flaws.
The second day saw competitors earn $232,500 for 45 unique zero-day vulnerabilities. Notable contributions came from PetoWorks, KAIST Hacking Lab's Kyeongmin Kim, and a collaborative team including Dimitrios Valsamaras, Ken Gannon, and Tenia Valsamara from CENSUS Labs, who collectively demonstrated three additional exploits against the Galaxy S26.
On the final day, researchers returned to exploit the Samsung Galaxy S26 and successfully rooted the Google Pixel 10 three times. This day's efforts yielded $641,000 in cash rewards for 21 newly demonstrated zero-day flaws, bringing the contest's total to 98 zero-days and $1,262,000 in payouts.
Wellness Healthcare Devices Debut as New Competition Category
Pwn2Own Ireland 2026 introduced a new competition category focused on wellness healthcare devices, expanding the scope of targets beyond traditional endpoints. Other targeted product lines included Apple's iPhone 17, which carried a maximum potential reward of $300,000 for a successful remote hack, though no research team registered an attempt against the device during the event.
ZDI Enforces Responsible Disclosure and 90-Day Patch Window
As part of the Zero Day Initiative's responsible disclosure policy, all exploits demonstrated at Pwn2Own Ireland 2026 were required to target devices running the latest firmware versions. Contestants had to achieve arbitrary code execution to validate their exploits. Vendors receiving zero-day disclosures during the event are obligated to develop and release patches within 90 days before ZDI publishes technical details publicly.
2025 Results Provide Context for 2026 Growth
The 2026 results represent a significant increase over the previous year's event. During Pwn2Own Ireland 2025, participating teams demonstrated 73 zero-day flaws and earned a total of $1,024,750 in rewards. The Summoning Team won that edition with $187,500 after exploiting the Samsung Galaxy S25, Home Assistant Green, QNAP TS-453E NAS, and multiple Synology devices.
Source: BleepingComputer