VinSOC (Organization): news timeline & CVEs

Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland

Researchers collected $232,500 at Pwn2Own Ireland after 45 zero-days, including three Samsung Galaxy S26 hacks.

On day two of Pwn2Own Ireland 2026, researchers earned $232,500 by exploiting 45 unique zero-days in fully patched devices. Samsung's Galaxy S26 was compromised three times by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab. Other successful targets included the Sonos Era 300, Home Assistant Green, Philips Hue Bridge Pro, and Oracle Autonomous AI Database via multi-bug chains. Trend Micro's ZDI gives vendors 90 days to patch before public disclosure; in-the-wild exploitation was not reported.

BleepingComputerupdated Oct 8, 10:41 UTC · 13h agofirst Oct 8, 06:32 UTC · 17h agoExploit / PoC 8 sources1

Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One

Day one of Pwn2Own Ireland 2026 yielded 32 demonstrated zero-days against phones, smart home devices, printers, and AI tools, earning $368,000.

On day one of the Zero Day Initiative's Pwn2Own Ireland 2026 in Cork, teams earned over $368,000 demonstrating 32 zero-day vulnerabilities in smartphones, smart home devices, printers, and AI tools. Highlights included VinSOC chaining seven zero-days against the Philips Hue Bridge Pro and five against Oracle Autonomous AI Database, while OpenAI Codex fell to an argument injection bug and LiteLLM to code injection yielding a reverse shell. Findings are responsibly disclosed, with vendors given 90 days to patch before ZDI publication. Google separately reported vulnerability disclosures doubling from 5,045 in January 2026 to 10,740 in August.

Infosecurity Magazineupdated Oct 8, 10:41 UTC · 13h agofirst Oct 7, 09:25 UTC · 1d agoVulnerability 8 sources1

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

Researchers exploited 32 zero-days for $388,500 on day one of Pwn2Own Ireland, hacking Samsung Galaxy S26 twice and Oracle's AI database.

On the first day of Pwn2Own Ireland 2026, competitors earned $388,500 exploiting 32 zero-days, with Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security hacking the Samsung Galaxy S26 twice. Leaderboard-topping VinSOC researchers earned $80,000 combining a seven-zero-day chain against the Philips Hue Bridge Pro and a five-zero-day chain against the Oracle Autonomous AI Database. Other demos hit LiteLLM, Lexmark and Canon printers, the Sonos Era 300, and the OpenAI Codex cloud coding agent via a single argument-injection bug. Trend Micro's Zero Day Initiative gives vendors 90 days to patch before public disclosure.

BleepingComputerupdated Oct 8, 10:41 UTC · 13h agofirst Oct 6, 19:21 UTC · 2d agoExploit / PoC 8 sources1

Pwn2Own Ireland 2026 - The Full Schedule

ZDI posted the Pwn2Own Ireland 2026 schedule, with over 60 entries including phones and AI targets.

Trend Micro's Zero Day Initiative published the Pwn2Own Ireland 2026 schedule after a random draw in Cork. More than 60 entries span phones, smart home, printers, wellness, AI infrastructure, and coding agents, with attempts on 6-7 October 2026 (IST). The largest listed award is $300,000 and 30 Master of Pwn points for a remote Google Pixel 10 attempt. Other targets include Samsung Galaxy S26, Sonos Era 300, LiteLLM, and OpenAI Codex. No successful exploits are reported in the schedule.

Zero Day Initiative Blogupdated Oct 8, 10:41 UTC · 13h agofirst Oct 5, 18:11 UTC · 3d agoIndustry 8 sources

VinSOC

Timeline4 articles

Appears with

Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland

Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

Pwn2Own Ireland 2026 - The Full Schedule