Pwn2Own Ireland 2026 Awards $1.26 Million for 98 Zero-Days

Security researchers earned $1,262,000 at Pwn2Own Ireland 2026 after demonstrating 98 zero-day vulnerabilities over three days. The competition tested smartphones, AI products and other connected technologies through controlled hacking attempts.

Ikotas Labs finished first with 42.5 Master of Pwn points and $361,000 in rewards. Its successful demonstrations included the Samsung Galaxy S26, OpenAI Codex, Oracle Autonomous AI Database and Google Pixel 10.

These demonstrations took place under competition rules. They do not establish that attackers are exploiting the same vulnerabilities against users.

Ikotas Labs Wins With a Major Pixel 10 Exploit

The winning team secured the contest’s largest individual payout on the final day. By combining several zero-day vulnerabilities, Ikotas Labs compromised the Google Pixel 10 and earned $300,000.

Meanwhile, Xint placed second with $240,000 and 27.5 Master of Pwn points. Team ZyGoat finished third, also with 27.5 points, and collected $125,000.

The Pixel 10 featured prominently during the final round, with researchers successfully compromising the device three times.

Competitors also gained root access to the Galaxy S26 again, extending a series of successful demonstrations against Samsung’s flagship.

Smartphone Demonstrations Span All Three Days

On the opening day, Interrupt Labs, Ikotas Labs and Viettel Cyber Security researcher Nguyen Thanh Dat successfully targeted the Galaxy S26.

However, Samsung already knew about some of the vulnerabilities involved in those attempts.

The second day brought three more successful Galaxy S26 demonstrations. These came from PetoWorks, KAIST Hacking Lab’s Kyeongmin Kim, and a team comprising Dimitrios Valsamaras, Ken Gannon and CENSUS Labs’ Tenia Valsamara.

Across all product categories, the daily results were:

• Day one: 32 zero-day vulnerabilities and $388,500 in rewards.
• Day two: 45 unique zero-day vulnerabilities and $232,500 in rewards.
• Day three: 21 zero-day vulnerabilities and $641,000 in rewards.

Consequently, the final day delivered the largest share of the prize money, despite featuring fewer vulnerabilities than either earlier day.

Researchers Target AI and Connected Devices

Pwn2Own Ireland 2026 attracted 29 research teams across seven categories.

Alongside mobile phones, the targets included AI infrastructure, AI coding applications, messaging apps, smart home products and printers. A new category also covered wellness and healthcare devices.

Apple’s iPhone 17 was available as a target, with a maximum $300,000 reward for a remote compromise. However, no contestant registered an attempt.

Its absence from the results therefore reflects a lack of entries, rather than a failed attempt or proof that the device has no vulnerabilities.

Vendors Receive Time to Address Disclosed Flaws

Trend Micro’s Zero Day Initiative organizes Pwn2Own to uncover security weaknesses before malicious actors exploit them.

Competition rules require targets to run the latest available firmware or software versions. Researchers must also demonstrate a successful compromise and arbitrary code execution.

Following disclosure, vendors receive a 90-day window to address the vulnerabilities before ZDI publicly releases technical details.

This process gives manufacturers and software developers time to prepare fixes while researchers document their findings.

Rewards and Vulnerability Counts Exceed Last Year

The 2026 event surpassed the previous edition in both total rewards and demonstrated zero-days.

At Pwn2Own Ireland 2025, researchers earned $1,024,750 for 73 vulnerabilities. This year’s totals represent an additional $237,250 in payouts and 25 more flaws.

Summoning Team won the 2025 competition with $187,500 after compromising products including the Galaxy S25, Home Assistant Green and several network storage devices.