Samsung Galaxy S26 Targeted Again on Day Two of Pwn2Own Ireland 2026
On the second day of Pwn2Own Ireland 2026, security researchers successfully exploited the Samsung Galaxy S26 flagship smartphone three separate times, contributing to a total of $232,500 in cash awards distributed across 45 unique zero-day vulnerabilities discovered during the event. The exploits were demonstrated by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab's Dimitrios Valsamaras and Ken Gannon.
Exploit Demonstrations and Awards Breakdown
Each successful exploit chain targeting the Galaxy S26 met Pwn2Own's strict requirements: contestants had to compromise fully patched devices running the latest firmware and demonstrate arbitrary code execution. The vulnerabilities discovered were previously unknown to Samsung and classified as zero-days at the time of disclosure.
Jack Dates of RET2 Systems also drew attention by demonstrating a Sonos Era 300 exploit chain in under a minute. Meanwhile, Out of Bounds team's HaeJung Yang received a $40,000 award for hacking Dynamo in the AI Infrastructure category.
Additional Device Exploits Reported
Beyond mobile devices, several other platforms were compromised. PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Doyensec's Yassine Bengana and Maxence Schmitt successfully hacked the Home Assistant Green smart home hub. Ikotas Labs breached the Oracle Autonomous AI Database using a seven-chain zero-day exploit.
Before the day's activities commenced, Kyeongmin Kim withdrew his planned USB-based attack attempt against the Google Pixel 10.
About Pwn2Own Ireland and Zero Day Initiative
Pwn2Own Ireland 2026 is organized by Trend Micro's Zero Day Initiative (ZDI), which aims to identify and responsibly disclose zero-day vulnerabilities in widely used software and hardware before they can be exploited maliciously. All devices used in the competition are required to run the latest available firmware versions.
According to ZDI's responsible disclosure policy, vendors receive a 90-day window to develop and deploy patches for disclosed vulnerabilities before ZDI makes the details public.
Competition Categories and Notable Absences
The Pwn2Own Ireland 2026 contest features seven target categories: mobile phones (including Samsung Galaxy S26 and Google Pixel 10), messaging apps, smart home devices, printers, AI infrastructure, AI coding applications, and a newly introduced category focused on wellness healthcare devices.
Although Apple's iPhone 17 was listed as a potential target with a maximum possible award of $300,000 for a remote exploit, no contestant registered an attempt against it during the event.
Day One Results and Prior Exploits
On the first day of Pwn2Own Ireland 2026, Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security also successfully hacked the Samsung Galaxy S26. However, some of the vulnerabilities exploited on day one were already known to Samsung, distinguishing them from the novel zero-days demonstrated on day two.
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC led the first-day leaderboard, earning $40,000 for a five-zero-day exploit chain targeting the Oracle Autonomous AI Database and an additional $40,000 for chaining seven zero-days to compromise a Philips Hue Bridge Pro smart lighting hub.
Outlook and Historical Context
On the third day of Pwn2Own Ireland 2026, researchers are expected to attempt exploits against multiple smart home, AI infrastructure, and printer devices, with renewed efforts targeting both the Samsung Galaxy S26 and Google Pixel 10 smartphones.
For comparison, during the 2025 edition of Pwn2Own Ireland, hackers demonstrated 73 zero-day flaws and collectively earned $1,024,750. The Summoning Team won that year's competition by securing $187,500 through exploits against the Samsung Galaxy S25, Home Assistant Green, QNAP TS-453E NAS, and several Synology devices.
Source: BleepingComputer