Pwn2Own Ireland 2026 Awards $1,262,000 for 98 Zero-Days

Researchers earned $1,262,000 for 98 zero-days at Pwn2Own Ireland 2026; Ikotas Labs took Master of Pwn with a $300,000 Pixel 10 chain.

Trend Micro’s Zero Day Initiative concluded Pwn2Own Ireland 2026 in Cork with $1,262,000 paid for 98 demonstrated zero-days, which BleepingComputer split into 32 flaws for $388,500, 45 for $232,500, and 21 for $641,000; Infosecurity Magazine put the day-one purse at over $368,000. Ikotas Labs won Master of Pwn with 42.5 points and $361,000, including a $300,000 remote multi-bug chain against a fully patched Google Pixel 10, and also compromised the Samsung Galaxy S26, OpenAI Codex with one argument-injection bug worth $40,000, and Oracle Autonomous AI Database. Three teams remotely hacked the Pixel 10; The Hacker News reported a combined $562,500 and said most Pixel and Galaxy S26 entries were collisions on bugs vendors already knew, with only one confirmed zero-day in the Pixel chains, while SecurityWeek said Pixel prizes totaled $560,000 and named Tim Becker and Yves Bieri ($150,000) and Dimitrios Valsamaras and Ken Gannon ($112,500). Other targets included VinSOC’s day-one chains of seven zero-days on the Philips Hue Bridge Pro and five on Oracle for $80,000, LiteLLM, Sonos Era 300 for $50,000, Home Assistant Green, Nvidia Dynamo, Lexmark, Brother, and Canon printers, and Garmin Index BPM; outlets disagreed on whether day one produced two or three Galaxy S26 compromises, and day two added three more by KAIST Hacking Lab’s Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab. An early ZDI day-one update reported only a failed Ikotas Labs attempt on the Brother MFC-L8970CDW and no successes, later superseded by the full day-one tally, and one Pixel 10 attempt was also reported to fail that day. Vendors get 90 days to patch, 51 of 63 scheduled attempts succeeded, iPhone 17 and WhatsApp prizes of up to $300,000 each went unclaimed, contest bugs were not reported exploited in the wild, and Google separately noted CVE-2026-58704, a Pixel modem flaw possibly under limited targeted exploitation and fixed at patch level 2026-09-05, which coverage did not tie to the contest.