Samsung Galaxy S26 Hacks Add Three More Successful Pwn2Own Demonstrations

Three more Samsung Galaxy S26 hacks featured on the second day of Pwn2Own Ireland 2026. Across the day’s competition, researchers earned $232,500 after exploiting 45 unique zero-day vulnerabilities in multiple products.

The successful phone demonstrations came from KAIST Hacking Lab’s Kyeongmin Kim, PetoWorks, and a team comprising Dimitrios Valsamaras, Ken Gannon and CENSUS Labs’ Tenia Valsamara.

These were controlled security demonstrations at the competition, rather than reports of attacks against Galaxy users.

Galaxy S26 Faces Repeated Successful Attempts

The latest Samsung Galaxy S26 hacks followed three successful demonstrations against the same model on the opening day.

Those earlier attempts involved Interrupt Labs, Ikotas Labs and Viettel Cyber Security’s Nguyen Thanh Dat. However, Samsung already knew about some of the vulnerabilities used during those demonstrations.

Meanwhile, Kyeongmin Kim withdrew a planned USB-based attempt against the Google Pixel 10 before the second day began.

The competition’s third-day schedule includes further attempts against both the Galaxy S26 and Pixel 10, alongside other device categories.

Researchers Also Compromise AI and Smart Home Products

Beyond smartphones, contestants demonstrated successful attacks against connected home devices and AI infrastructure.

RET2 Systems researcher Jack Dates demonstrated a Sonos Era 300 exploit chain in under a minute. Meanwhile, HaeJung Yang from the Out of Bounds team earned $40,000 for compromising Dynamo in the AI Infrastructure category.

Home Assistant Green also faced multiple successful attempts. Participants included PetoWorks, Xint’s Yves Bieri, Kyeongmin Kim, _McCaulay, and Doyensec researchers Yassine Bengana and Maxence Schmitt.

Additionally, Ikotas Labs compromised Oracle Autonomous AI Database through a chain involving seven zero-day vulnerabilities.

These results highlight the range of products under examination, from household hubs to enterprise AI systems.

Competition Tests Fully Updated Devices

Trend Micro’s Zero Day Initiative organizes Pwn2Own to uncover vulnerabilities before criminals exploit them.

Under the competition rules, target devices run the latest available firmware. Contestants must compromise their chosen target and demonstrate arbitrary code execution.

Following disclosure through the event, vendors receive 90 days to develop patches before ZDI publishes vulnerability details.

This year’s competition covers seven categories: mobile phones, messaging applications, smart home devices, printers, AI infrastructure, AI coding applications and wellness healthcare devices.

Apple’s iPhone 17 was also available as a target, with a maximum $300,000 award for a remote compromise. However, no contestants registered an attempt against it.

Opening-Day Results Included Two Major Exploit Chains

VinSOC researchers Vũ Chí Thành and Huỳnh Đức Tin led the standings after the first day.

They earned $40,000 for chaining five zero-day vulnerabilities against Oracle Autonomous AI Database. They also received another $40,000 for a seven-vulnerability chain targeting the Philips Hue Bridge Pro.

The third day will bring further attempts against smart home products, AI infrastructure and printers, in addition to the scheduled smartphone demonstrations.

For comparison, Pwn2Own Ireland 2025 awarded $1,024,750 for 73 zero-day vulnerabilities. Summoning Team won that event and collected $187,500 through successful attacks on Samsung, Home Assistant, QNAP and Synology products.