Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One
Day one of Pwn2Own Ireland 2026 yielded 32 demonstrated zero-days against phones, smart home devices, printers, and AI tools, earning $368,000.
On day one of the Zero Day Initiative's Pwn2Own Ireland 2026 in Cork, teams earned over $368,000 demonstrating 32 zero-day vulnerabilities in smartphones, smart home devices, printers, and AI tools. Highlights included VinSOC chaining seven zero-days against the Philips Hue Bridge Pro and five against Oracle Autonomous AI Database, while OpenAI Codex fell to an argument injection bug and LiteLLM to code injection yielding a reverse shell. Findings are responsibly disclosed, with vendors given 90 days to patch before ZDI publication. Google separately reported vulnerability disclosures doubling from 5,045 in January 2026 to 10,740 in August.