Pwn2Own Ireland Day Two: Galaxy S26 Falls Three More Times

On the second day of the Pwn2Own Ireland 2026 hacking contest, security researchers collected a combined $232,500 in prizes after successfully exploiting 45 unique zero-day vulnerabilities.

The highlight of the day was the Samsung Galaxy S26: the flagship was hacked three times, by Kyeongmin Kim of KAIST Hacking Lab, the PetoWorks team, and Dimitrios Valsamaras and Ken Gannon of Mobile Hacking Lab.

Speakers, smart homes and AI infrastructure

Jack Dates of RET2 Systems demonstrated an exploit chain against the Sonos Era 300 speaker in under a minute. HaeJung Yang of the Out of Bounds team was awarded $40,000 for hacking Dynamo in the AI Infrastructure category.

Several competitors — PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Yassine Bengana and Maxence Schmitt of Doyensec — breached the Home Assistant Green smart home hub. The Ikotas Labs team cracked the Oracle Autonomous AI Database using a chain of seven zero-days.

Before day two began, Kyeongmin Kim withdrew his attempt at a USB-based attack targeting the Google Pixel 10.

Rules and context

The contest is organized by Trend Micro's Zero Day Initiative (ZDI) to surface vulnerabilities in fully patched devices before attackers can exploit them in the wild. Under the rules, all devices run the latest firmware, and contestants must demonstrate arbitrary code execution. Once flaws are disclosed, vendors have 90 days to issue patches.

Competitors target products across seven categories: smartphones (Galaxy S26 and Pixel 10), messaging apps, smart home devices, printers, AI infrastructure, AI coding apps, and a new category covering wellness healthcare devices. Apple's iPhone 17 was also on the list, with a top award of $300,000 for a remote hack, but no one signed up to attempt it.

On day one, the Galaxy S26 had already been hacked by Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security, though some of the bugs used were already known to the vendor. Day-one leaders Vũ Chí Thành and Huỳnh Đức Tin of VinSOC earned $40,000 for a five-zero-day chain against the Oracle Autonomous AI Database, plus another $40,000 for a seven-zero-day attack on the Philips Hue Bridge Pro lighting hub.

On the third day, contestants will take fresh runs at smart home devices, AI infrastructure, printers, and the Galaxy S26 and Pixel 10 smartphones. For comparison: Pwn2Own Ireland 2025 saw 73 zero-days demonstrated and a prize pool north of a million dollars.

Source: Bleeping Computer