Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
Researchers exploited 32 zero-days for $388,500 on day one of Pwn2Own Ireland, hacking Samsung Galaxy S26 twice and Oracle's AI database.
On the first day of Pwn2Own Ireland 2026, competitors earned $388,500 exploiting 32 zero-days, with Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security hacking the Samsung Galaxy S26 twice. Leaderboard-topping VinSOC researchers earned $80,000 combining a seven-zero-day chain against the Philips Hue Bridge Pro and a five-zero-day chain against the Oracle Autonomous AI Database. Other demos hit LiteLLM, Lexmark and Canon printers, the Sonos Era 300, and the OpenAI Codex cloud coding agent via a single argument-injection bug. Trend Micro's Zero Day Initiative gives vendors 90 days to patch before public disclosure.
- 32 zero-days exploited for $388,500 on day one of Pwn2Own Ireland 2026.
- Samsung Galaxy S26 hacked twice; Galaxy S25 was top target last year.
- VinSOC earned $80,000 for Philips Hue Bridge Pro and Oracle Autonomous AI Database chains.
- OpenAI Codex cloud agent fell to a single argument-injection bug.
- Vendors have 90 days to patch before ZDI publicly discloses flaws.
Full article452 words · extracted from bleepingcomputer.com · click to collapse
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days.
During the Pwn2Own Ireland 2026 hacking contest, competitors target products in seven categories, including mobile phones (Apple iPhone 17, Samsung Galaxy S26, and Google Pixel 10), printers, smart home devices, messaging apps, AI infrastructure, AI coding apps, and a new category where hackers will try to exploit wellness healthcare devices.
The highlight of the first day was Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security hacking Samsung's Galaxy S26 flagship. However, some of the bugs exploited in each challenge were already known to the vendor.
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC, who topped the leaderboard, won $40,000 after chaining seven zero-days to exploit a Philips Hue Bridge Pro smart lighting hub, plus an additional $40,000 for a five zero-day exploit chain targeting the Oracle Autonomous AI Database.
Security researchers also demoed LiteLLM zero-days, hacked the Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers, took down the OpenAI Codex cloud-based AI coding agent with a single argument-injection bug, and exploited four vulnerabilities to compromise a Sonos Era 300 smart speaker again.
Mikhail Evdokimov, Polina Smirnova, and Mate Zombor of White Noise Club also targeted the Google Pixel 10 today, but couldn't get their exploit to work within the allotted time.
The Zero Day Initiative (ZDI) organizes this hacking competition to identify zero-day vulnerabilities in targeted devices before threat actors can exploit them. After flaws are exploited at Pwn2Own, vendors have 90 days to release security updates before Trend Micro's ZDI publicly discloses them.
On the second day of the contest, hackers will again target devices in the AI infrastructure, printers, smart home, and wellness categories, as well as the Samsung Galaxy S26 and the Google Pixel 10 in the mobile phones category.
On the third day, they will attempt to hack the Google Pixel 10 and Samsung Galaxy S26 flagships again, as well as multiple smart home, AI infrastructure, and printer devices.
During last year's Pwn2Own Ireland event, security researchers earned $1,024,750 for 73 zero-day flaws, with Summoning Team collecting $187,500 after hacking the Samsung Galaxy S25, the Synology DiskStation DS925+ NAS, the Home Assistant Green, the Synology ActiveProtect Appliance DP320 NAS drive, the Synology CC400W camera, and the QNAP TS-453E NAS.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.