Pwn2Own Ireland 2026 reveals six Samsung Galaxy S26 zero-day hacks
Security researchers earned $232,500 exploiting 45 zero-days on day two of Pwn2Own Ireland 2026, with Samsung's flagship phone hacked six times in 48 hours, highlighting critical vulnerabilities before patches.
The Samsung Galaxy S26 was successfully hacked six times across the first two days of Pwn2Own Ireland 2026. On October 6 and 7, three separate exploits each day compromised the flagship device, making it the most targeted product of the contest. KAIST Hacking Lab's Kyeongmin Kim and Mobile Hacking Lab's Dimitrios Valsamaras were among the participants who hacked the phone, alongside teams from Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security.
Multiple teams demonstrated diverse exploit chains across categories
Competitors targeted a wide range of devices beyond mobile phones. The event's new AI Infrastructure category saw significant action. Ikotas Labs earned $40,000 for compromising OpenAI Codex on the first day. Out of Bounds team's HaeJung Yang was awarded $40,000 for hacking Dynamo in the same category. Xint’s Taisic Yun obtained a reverse shell on LiteLLM through improper input validation and code injection, also earning $40,000.
Smart home and enterprise devices were also heavily exploited. Vũ Chí Thành and Huỳnh Đức Tin of VinSOC won $40,000 for chaining seven zero-days to exploit a Philips Hue Bridge Pro. The same hub was hacked four times on the opening day. Jack Dates of RET2 Systems demoed a Sonos Era 300 exploit chain in under a minute. That win netted a $50,000 payout for an out-of-bounds write and format string bug.
Other successful exploits included the Lexmark CX532adwe printer, hacked at least four times, and the Garmin Index BPM smart scale, which earned Interrupt Labs $20,000. The table below summarizes key payouts for specific device exploits.
| Device/Category | Research Team | Key Flaw(s) | Payout |
|---|---|---|---|
| Samsung Galaxy S26 | Multiple Teams | Various zero-day chains | Multiple awards |
| Philips Hue Bridge Pro | VinSOC | Seven-bug chain | $40,000 |
| Sonos Era 300 | RET2 Systems (Jack Dates) | Out-of-bounds write, format string | $50,000 |
| Oracle Autonomous AI Database | VinSOC | Five-zero-day chain | $40,000 |
| OpenAI Codex | Ikotas Labs | Seven-chain exploit | $40,000 |
| Dynamo (AI Infrastructure) | Out of Bounds (HaeJung Yang) | Not specified | $40,000 |
| Garmin Index BPM | Interrupt Labs | Out-of-bounds read and write | $20,000 |
Pwn2Own Ireland 2026 set records in participation and payouts
By the close of day two, the event had paid out at least $608,500 for 45 unique zero-day vulnerabilities exploited that day alone. This surpassed the entire day-one total from the 2025 contest. Day one of the 2026 event had already paid $388,500 for 32 unique zero-days. The competition attracted more than 60 entries with a record number of phone attempts, featuring 21 scheduled attempts on the first day and 24 on the second. Each team operates within a fixed time slot of 15 to 30 minutes. A successful demonstration earns the full prize, while partial success involving known bugs results in a reduced payout.
The 2026 edition introduced an AI Infrastructure category not present the previous year. For comparison, Pwn2Own Ireland 2025 paid $522,500 for 34 zero-days on its first day and reached a cumulative $792,750 by the end of day two. Trend Micro's Zero Day Initiative (ZDI) organizes the contest, which began on October 6 in Cork, Ireland.
Responsible disclosure timelines begin for exploited zero-days
All devices in the competition run the latest firmware. Contestants must compromise the target and demonstrate arbitrary code execution. This process identifies flaws in fully patched devices before malicious actors can weaponize them. Now, a 90-day clock is ticking for vendors. ZDI's responsible disclosure process gives companies including Samsung, Google, Oracle, Philips, Sonos, Lexmark, and OpenAI a fixed window to develop and ship patches before the vulnerabilities are made public.
On the third day, attempts were scheduled for the Samsung Galaxy S26 and Google Pixel 10 smartphones again, alongside smart home, AI infrastructure, and printer devices. The Home Assistant Green smart home hub was the single most-targeted device on day two, with four of five scheduled attempts succeeding. Throughout the event, competitors targeted products across seven categories. Apple's iPhone 17 was a potential target with a maximum award of $300,000 for a remote hack, but no contestant registered for an attempt.
