Pwn2Own Ireland 2026 Sets Day Three After Zero-Day Results

ZDI scheduled 17 day-three attempts worth about $1.33 million after day one paid $388,500 for 32 zero-days and day two $232,500 for 45.

Trend Micro's Zero Day Initiative held Pwn2Own Ireland 2026 in Cork after a 5 October schedule of more than 60 entries spanning phones, smart home, printers, wellness devices, AI infrastructure, and coding agents, with attempts set for 6-7 October and a top listed award of $300,000 and 30 Master of Pwn points for a remote Google Pixel 10. An early day-one note covering 21 entries said only that Ikotas Labs failed to exploit the Brother MFC-L8970CDW in time; ZDI, BleepingComputer, and Cyber Security News later reported 32 unique zero-days and $388,500, while Infosecurity Magazine reported over $368,000. Day-one successes included VinSOC earning $80,000 from a seven-zero-day chain on the Philips Hue Bridge Pro and a five-zero-day chain on Oracle Autonomous AI Database, Ikotas Labs earning $40,000 for an argument-injection bug in OpenAI Codex, and Taisic Yun obtaining a reverse shell on LiteLLM via improper input validation plus code injection, plus Lexmark, Canon, and Sonos Era 300 demos, while one Google Pixel 10 attempt failed in time. Sources disagree on that day's Samsung Galaxy S26: BleepingComputer said it was hacked twice and named Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security, whereas Cyber Security News said three teams used four-bug chains. On day two, after ZDI listed 24 attempts worth about $780,000, BleepingComputer reported $232,500 for 45 unique zero-days in fully patched devices, including three further Galaxy S26 compromises by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab, and successes against the Sonos Era 300, Home Assistant Green, Philips Hue Bridge Pro, and a seven-bug Oracle chain. ZDI gives vendors 90 days to patch, says demonstrations do not imply real-user attacks, and no in-the-wild exploitation or iPhone 17 entries were reported despite a $300,000 purse; ZDI then scheduled 17 day-three attempts worth about $1.33 million, led by three Pixel 10 tries, with Master of Pwn still open.

• ZDI scheduled Pwn2Own Ireland 2026 in Cork for 6-7 October 2026 with more than 60 entries; the top listed award was $300,000 and 30 Master of Pwn points for a remote Google Pixel 10.
• Day one: ZDI, BleepingComputer, and Cyber Security News reported 32 unique zero-days and $388,500; Infosecurity Magazine reported over $368,000. An early ZDI update on 21 entries reported only Ikotas Labs timing out on the Brother…
• Day-one results included VinSOC's $80,000 (seven zero-days on Philips Hue Bridge Pro; five on Oracle Autonomous AI Database), Ikotas Labs' $40,000 OpenAI Codex argument-injection bug, Taisic Yun's LiteLLM reverse shell, and a failed Google…
• Galaxy S26 on day one: BleepingComputer said it was hacked twice while naming Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security; Cyber Security News said three teams used four-bug chains.
• Day two paid $232,500 for 45 unique zero-days, including three further Galaxy S26 hacks by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab, and a seven-bug chain on Oracle Autonomous AI Database.
• Vendors have 90 days to patch; ZDI says demos do not imply real-user attacks. No in-the-wild exploitation was reported, and no iPhone 17 attempts registered despite a $300,000 purse.
• ZDI's day-three schedule lists 17 attempts and about $1.33 million, led by three Google Pixel 10 entries; Master of Pwn was still undecided. Day two had been listed as 24 attempts worth about $780,000.
• Infosecurity also cited Google saying vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August 2026.