Pwn2Own Ireland 2026: 32 zero-days and $388,500 on day one

The first day of Pwn2Own Ireland 2026 has wrapped up, netting participants $388,500 for exploiting 32 zero-day vulnerabilities. The highlight was the flagship Samsung Galaxy S26 falling — not once, but twice.

Competitors target devices across seven categories: phones (Apple iPhone 17, Samsung Galaxy S26 and Google Pixel 10), printers, smart home gear, messaging apps, AI infrastructure, AI coding tools, and a new category covering wellness and healthcare devices.

Who cracked what

The Galaxy S26 was taken down by Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security — though some of the bugs used in each challenge were already known to the vendor.

Topping the leaderboard were Vũ Chí Thành and Huỳnh Đức Tin of VinSOC. They earned $40,000 for chaining seven zero-days to take over the Philips Hue Bridge Pro smart lighting hub, plus another $40,000 for a five-bug chain against the Oracle Autonomous AI Database.

Researchers also demonstrated zero-days in LiteLLM, hacked the Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers, knocked out OpenAI's cloud-based Codex coding agent with a single argument-injection bug, and once again compromised a Sonos Era 300 smart speaker using four vulnerabilities.

The White Noise Club team (Mikhail Evdokimov, Polina Smirnova and Mate Zombor) went after the Google Pixel 10 but couldn't get their exploit working within the allotted time.

The rules and the context

The contest is run by Trend Micro's Zero Day Initiative (ZDI) to surface vulnerabilities before malicious actors do. After a successful demo, vendors have 90 days to ship fixes before ZDI publicly discloses the details.

Two more days lie ahead: competitors will again tackle the Galaxy S26 and Pixel 10, along with devices in the AI infrastructure, printer, smart home and wellness categories.

For comparison, last year's Pwn2Own Ireland saw researchers earn $1,024,750 for 73 zero-day flaws.

Source: Bleeping Computer