Security researchers demonstrated 32 zero-day vulnerabilities on the opening day of Pwn2Own Ireland 2026, earning a combined $388,500. Successful demonstrations targeted smartphones, AI systems, printers and smart home equipment.
The results show how security weaknesses can affect both everyday connected devices and newer AI platforms. However, some demonstrations involved bugs already known to vendors, meaning not every exploited flaw qualified as a new discovery.
Galaxy S26 Draws Multiple Research Teams
Samsung’s Galaxy S26 featured prominently in the first day’s mobile phone challenges.
Interrupt Labs, Ikotas Labs and Viettel Cyber Security researcher Nguyen Thanh Dat demonstrated attacks against the flagship device. However, organizers identified previously known vulnerabilities in some of the attempts.
Meanwhile, White Noise Club researchers Mikhail Evdokimov, Polina Smirnova and Mate Zombor targeted Google’s Pixel 10. Their exploit did not succeed within the competition’s allotted time.
That outcome reflects the timed demonstration rather than establishing that the device has no vulnerabilities.
VinSOC Leads After Two Successful Exploit Chains
VinSOC researchers Vũ Chí Thành and Huỳnh Đức Tin finished the opening day at the top of the leaderboard.
The pair earned $40,000 by combining seven zero-day vulnerabilities to compromise a Philips Hue Bridge Pro smart lighting hub.
They then collected another $40,000 for a separate attack against Oracle Autonomous AI Database. That demonstration used a chain of five zero-day vulnerabilities.
Together, the two successful attempts earned the researchers $80,000 and highlighted the role of multi-step attacks in the contest.
AI Platforms Join Printers and Smart Speakers as Targets
The first day of Pwn2Own Ireland 2026 also included successful demonstrations against AI infrastructure and coding tools.
Researchers exploited vulnerabilities in LiteLLM and demonstrated an attack against OpenAI’s cloud-based Codex coding agent using a single argument-injection flaw.
Elsewhere, competitors compromised Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers. Attacks against the Sonos Era 300 smart speaker also involved four vulnerabilities.
These demonstrations took place within the competition. They do not establish that attackers are exploiting the same weaknesses against users outside the event.
Seven Categories Expand the Competition’s Scope
This year’s contest covers mobile phones, printers, smart home devices, messaging applications, AI infrastructure and AI coding applications.
Additionally, organizers introduced a wellness category focused on healthcare-related devices. The mobile lineup includes Apple’s iPhone 17, Samsung’s Galaxy S26 and Google’s Pixel 10.
Further attempts scheduled for October 7 and 8 include Samsung and Google phones, alongside AI infrastructure, printers and smart home products. The second day also includes wellness targets.
Vendors Receive Time to Develop Fixes
The Zero Day Initiative organizes Pwn2Own to uncover vulnerabilities and report them to vendors before criminals can exploit them.
Following a successful demonstration, vendors have 90 days to release security updates before ZDI publicly discloses the findings.
For comparison, the previous Pwn2Own Ireland event awarded $1,024,750 for 73 zero-day vulnerabilities. Summoning Team earned $187,500 after successful attacks against several products, including Samsung’s Galaxy S25 and multiple network-connected devices.
The opening-day total represents only the first stage of this year’s competition, with additional demonstrations still scheduled.
0 responses to “Pwn2Own Ireland 2026 Opens With 32 Zero-Days and $388,500 in Awards”