Ikotas Labs (Organization): news timeline & CVEs

Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn

Pwn2Own Ireland day three lists 17 scheduled attempts, led by three Google Pixel 10 entries.

Zero Day Initiative previewed day three of Pwn2Own Ireland 2026, with 17 scheduled attempts and about $1.33 million in prizes. Google Pixel 10 is the headline target with three attempts, and Samsung Galaxy S26 has one more run. Other targets include Philips Hue Bridge Pro, Home Assistant Green, Oracle Autonomous AI Database, Chroma, and Brother, Canon, and Lexmark printers. The post is a schedule rather than confirmed results, and says Master of Pwn could remain open into the final hour.

Zero Day Initiative Blog10:41 UTC · 12h agoIndustry 8 sources1

Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland

Researchers collected $232,500 at Pwn2Own Ireland after 45 zero-days, including three Samsung Galaxy S26 hacks.

On day two of Pwn2Own Ireland 2026, researchers earned $232,500 by exploiting 45 unique zero-days in fully patched devices. Samsung's Galaxy S26 was compromised three times by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab. Other successful targets included the Sonos Era 300, Home Assistant Green, Philips Hue Bridge Pro, and Oracle Autonomous AI Database via multi-bug chains. Trend Micro's ZDI gives vendors 90 days to patch before public disclosure; in-the-wild exploitation was not reported.

BleepingComputerupdated 10:41 UTC · 12h agofirst 06:32 UTC · 16h agoExploit / PoC 8 sources1

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

Researchers exploited 32 zero-days for $388,500 on day one of Pwn2Own Ireland, hacking Samsung Galaxy S26 twice and Oracle's AI database.

On the first day of Pwn2Own Ireland 2026, competitors earned $388,500 exploiting 32 zero-days, with Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security hacking the Samsung Galaxy S26 twice. Leaderboard-topping VinSOC researchers earned $80,000 combining a seven-zero-day chain against the Philips Hue Bridge Pro and a five-zero-day chain against the Oracle Autonomous AI Database. Other demos hit LiteLLM, Lexmark and Canon printers, the Sonos Era 300, and the OpenAI Codex cloud coding agent via a single argument-injection bug. Trend Micro's Zero Day Initiative gives vendors 90 days to patch before public disclosure.

BleepingComputerupdated 10:41 UTC · 12h agofirst Oct 6, 19:21 UTC · 2d agoExploit / PoC 8 sources1

Pwn2Own Ireland 2026 - Day One Results

Pwn2Own Ireland 2026 day one: Ikotas Labs failed to exploit a Brother printer in time.

Trend Micro’s Zero Day Initiative opened Pwn2Own Ireland 2026, with 21 entries scheduled across categories that included Samsung devices and a first Google Pixel attempt. The only Day One result published in this update is a failure: Ikotas Labs did not get an exploit of the Brother MFC-L8970CDW printer working before time expired. No successful compromises, CVE identifiers, or technical details were included.

Zero Day Initiative Blogupdated 10:41 UTC · 12h agofirst Oct 6, 09:28 UTC · 2d agoResearch 8 sources

Ikotas Labs

Timeline4 articles

Appears with

Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn

Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

Pwn2Own Ireland 2026 - Day One Results