Pwn2Own Ireland 2026 Kicks Off with Massive Zero-Day Exploit Haul
On the opening day of the Pwn2Own Ireland 2026 competition, security researchers demonstrated 32 previously unknown vulnerabilities across a range of consumer and enterprise technologies, earning a total of $388,500 in prizes. The event, organized by the Zero Day Initiative (ZDI), invites ethical hackers to identify and responsibly disclose zero-day flaws in widely used products before malicious actors can weaponize them.
Samsung Galaxy S26 Targeted Repeatedly on Day One
The Samsung Galaxy S26 emerged as a primary target, with teams from Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security successfully exploiting the device twice. Their combined efforts contributed significantly to the day’s total of 32 zero-days, though specific payout details for these exploits were not disclosed in the initial report.
VinSOC Team Tops Leaderboard with Dual Exploit Chains
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC led the leaderboard by chaining seven zero-day vulnerabilities to compromise a Philips Hue Bridge Pro smart lighting hub, earning $40,000. The same team also received an additional $40,000 for a separate five-zero-day exploit chain targeting the Oracle Autonomous AI Database, highlighting the growing attack surface in enterprise AI infrastructure.
Other Notable Exploits Across Printers, AI, and Smart Devices
Additional demonstrations included zero-day exploits affecting the Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers. Researchers also compromised a Sonos Era 300 smart speaker using four vulnerabilities, marking a repeat success from prior events. In the AI coding space, a single argument-injection vulnerability was sufficient to disable the OpenAI Codex cloud-based agent, underscoring the risks associated with AI-powered development tools.
LLM and Wellness Device Categories Under Scrutiny
The contest featured exploits targeting LiteLLM, reflecting increased focus on large language model infrastructures. Furthermore, a new competition category dedicated to wellness and healthcare devices was introduced, signaling growing concern over the security of consumer health technology. No successful exploits were reported in this category on day one.
Google Pixel 10 Resists Initial Attempts
Despite efforts by Mikhail Evdokimov, Polina Smirnova, and Mate Zombor of the White Noise Club, the Google Pixel 10 remained uncompromised on the first day, as their exploit failed to execute within the time limit. The device is scheduled for further attempts on days two and three of the event.
Pwn2Own Ireland 2026: Rules, Timeline, and Context
Following the ZDI’s responsible disclosure model, vendors have 90 days from the date of disclosure at Pwn2Own to issue patches before the details are made public. This window allows manufacturers to protect users while still contributing to broader security knowledge.
On day two, the competition will shift focus to AI infrastructure, printers, smart home, and wellness devices, with renewed attempts on the Samsung Galaxy S26 and Google Pixel 10. Day three will feature additional rounds targeting the same flagship smartphones, alongside multiple smart home, AI infrastructure, and printer systems.
Historical Context: Growth in Exploit Value and Volume
The 2026 event builds on the momentum of the previous year, during which researchers earned $1,024,750 for identifying 73 zero-day flaws. Notably, the Summoning Team secured $187,500 in 2025 by chaining exploits across the Samsung Galaxy S25, Synology DiskStation DS925+ NAS, Home Assistant Green, Synology ActiveProtect Appliance DP320, Synology CC400W camera, and QNAP TS-453E NAS.
Source: BleepingComputer