Pwn2Own Ireland Day 2: 45 Zero-Days, $232,500, Galaxy S26 Hacked

On the second day of Pwn2Own Ireland 2026, security researchers exploited 45 zero-day vulnerabilities and collected $232,500 in awards, according to bleepingcomputer.com. The Samsung Galaxy S26 was hacked three times during the day.

KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab's Dimitrios Valsamaras and Ken Gannon were credited with the three Galaxy S26 exploits. Kyeongmin Kim had withdrawn a separate USB-based attempt targeting the Google Pixel 10 before day two began.

In the AI Infrastructure category, the Out of Bounds team's HaeJung Yang won $40,000 for hacking Dynamo. Ikotas Labs breached the Oracle Autonomous AI Database using a seven-chain zero-day exploit. Jack Dates of RET2 Systems demonstrated a Sonos Era 300 exploit chain in under a minute.

In the smart-home category, PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Doyensec's Yassine Bengana and Maxence Schmitt hacked the Home Assistant Green smart home hub.

Day one, in context, saw Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security hack the Samsung Galaxy S26, though some of those bugs were already known to the vendor. Vũ Chí Thành and Huỳnh Đức Tin of VinSOC topped the day-one leaderboard with $40,000 for a five-zero-day Oracle Autonomous AI Database exploit chain and another $40,000 for a seven-zero-day Philips Hue Bridge Pro exploit. Trend Micro's Zero Day Initiative organizes Pwn2Own and gives vendors 90 days to patch disclosed zero-days.