On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days.
During the Pwn2Own Ireland 2026 hacking contest, competitors target products in seven categories, including mobile phones (Apple iPhone 17, Samsung Galaxy S26, and Google Pixel 10), printers, smart home devices, messaging apps, AI infrastructure, AI coding apps, and a new category where hackers will try to exploit wellness healthcare devices.
The highlight of the first day was Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security hacking Samsung’s Galaxy S26 flagship. However, some of the bugs exploited in each challenge were already known to the vendor.
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC, who topped the leaderboard, won $40,000 after chaining seven zero-days to exploit a Philips Hue Bridge Pro smart lighting hub, plus an additional $40,000 for a five zero-day exploit chain targeting the Oracle Autonomous AI Database.
Security researchers also demoed LiteLLM zero-days, hacked the Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers, took down the OpenAI Codex cloud-based AI coding agent with a single argument-injection bug, and exploited four vulnerabilities to compromise a Sonos Era 300 smart speaker again.
Mikhail Evdokimov, Polina Smirnova, and Mate Zombor of White Noise Club also targeted the Google Pixel 10 today, but couldn’t get their exploit to work within the allotted time.
The Zero Day Initiative (ZDI) organizes this hacking competition to identify zero-day vulnerabilities in targeted devices before threat actors can exploit them. After flaws are exploited at Pwn2Own, vendors have 90 days to release security updates before Trend Micro’s ZDI publicly discloses them.
On the second day of the contest, hackers will again target devices in the AI infrastructure, printers, smart home, and wellness categories, as well as the Samsung Galaxy S26 and the Google Pixel 10 in the mobile phones category.
On the third day, they will attempt to hack the Google Pixel 10 and Samsung Galaxy S26 flagships again, as well as multiple smart home, AI infrastructure, and printer devices.
During last year’s Pwn2Own Ireland event, security researchers earned $1,024,750 for 73 zero-day flaws, with Summoning Team collecting $187,500 after hacking the Samsung Galaxy S25, the Synology DiskStation DS925+ NAS, the Home Assistant Green, the Synology ActiveProtect Appliance DP320 NAS drive, the Synology CC400W camera, and the QNAP TS-453E NAS.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
