31 stories, newest first · one card per story
The researcher achieved shell access on Meta Ray-Ban smart glasses using firmware extraction and self-signed APK installation, bypassing signature checks in versions up to 126.
Attackers need low-privileged code in a container first; ZDI rates CVE-2026-91131 at CVSS 8.8.
Orange Tsai combined logical flaws in Edge and Windows features to gain code execution from an ordinary web page with no clicks; patch status is unconfirmed.
Orange Tsai’s Pwn2Own Berlin chain turns a malicious page into Windows code via UXSS and a writable protocol config, without memory corruption.
DEVCORE's chain needs no memory corruption and was fixed in Edge 148.0.3967.70 the day after the May contest.
DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.
ZDI scores the unauthenticated Pwn2Own zero-day at CVSS 8.8 for network-adjacent attackers.
Armory Castle used CVE-2026-102764 for file operations, then planted SAWFLY and BARECLAW on a few victims.
Three teams remotely hacked fully patched Pixel 10 phones at Pwn2Own Ireland; Ikotas Labs won the $300,000 top prize and Master of Pwn.
Pwn2Own Ireland 2026 awarded over $1.2 million; three teams earned $560,000 for Google Pixel 10 exploits, including Ikotas Labs' full $300,000 zero-day chain.
Pwn2Own Ireland 2026 paid $1,262,000 for 98 zero-days, including Galaxy S26, Pixel 10, and OpenAI Codex.
Pwn2Own Ireland day three lists 17 scheduled attempts, led by three Google Pixel 10 entries.
Researchers collected $232,500 at Pwn2Own Ireland after 45 zero-days, including three Samsung Galaxy S26 hacks.
ZDI posted the Pwn2Own Ireland 2026 schedule, with over 60 entries including phones and AI targets.
ZDI details CVE-2024-0244, an unauthenticated heap overflow in the Canon MF753Cdw exploited at Pwn2Own.
ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.
ZDI disclosed a Pwn2Own SSRF flaw (CVSS 5.4) in Home Assistant Green's SSDP server, letting unauthenticated network-adjacent attackers trigger arbitrary server-side requests.
ZDI-26-562 details an unauthenticated, network-adjacent SSRF in the Home Assistant Green mDNS server, rated CVSS 5.4 and originally demonstrated at Pwn2Own.
ZDI disclosed a Pwn2Own certificate validation flaw (CVSS 6.8) in Amazon Smart Plug's OTA process, allowing network-adjacent attackers to bypass update verification.
ZDI disclosed another Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent code execution after obtaining localhost access.
ZDI disclosed a Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent attackers to execute arbitrary code via localhost access.
ZDI disclosed a Pwn2Own information disclosure flaw (CVSS 4.3) in Amazon Smart Plug, letting unauthenticated network-adjacent attackers access sensitive information.
ZDI disclosed a Pwn2Own out-of-bounds write RCE (CVSS 7.5) in Amazon Smart Plug's OTA process, exploitable by unauthenticated network-adjacent attackers.
ZDI discloses a Pwn2Own Windows storport integer overflow local privilege escalation flaw (CVE-2026-65814, CVSS 8.8) requiring existing low-privileged code execution.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views