Pwn2Own Ireland 2026 Day One: 32 Zero-Days, $388,500

Security researchers exploited 32 zero-days and earned $388,500 in total on the first day of Pwn2Own Ireland 2026, according to BleepingComputer. The Samsung Galaxy S26 was hacked twice during the opening day of the contest.

Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security were the teams credited with compromising the Samsung Galaxy S26. Organizers noted that some of the bugs used in the challenges were already known to the vendor.

VinSOC researchers Vũ Chí Thành and Huỳnh Đức Tin topped the leaderboard with $80,000 from two exploits. They won $40,000 for chaining seven zero-days against a Philips Hue Bridge Pro, and another $40,000 for a five zero-day chain targeting the Oracle Autonomous AI Database.

Other targets fell as well. Researchers demonstrated LiteLLM zero-days, compromised the Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers, and exploited four vulnerabilities to compromise a Sonos Era 300 smart speaker again. The OpenAI Codex cloud AI coding agent was taken down with a single argument-injection bug, while White Noise Club targeted the Google Pixel 10 but failed to complete the exploit within the allotted time.

Previous editions set a higher bar

During last year's Pwn2Own Ireland event, security researchers earned $1,024,750 for 73 zero-day flaws. In that edition, Summoning Team collected $187,500 after hacking the Samsung Galaxy S25, Synology DiskStation DS925+ NAS, Home Assistant Green, Synology ActiveProtect Appliance DP320 NAS drive, Synology CC400W camera, and QNAP TS-453E NAS.