Pwn2Own Ireland Researchers Earn $1.262 Million for Demonstrating 98 Zero-Days
Summary
Researchers earned $1.262 million after demonstrating 98 zero-day flaws across products at Pwn2Own Ireland 2026. ZDI says vendors must patch disclosed flaws within 90 days before details are made public.
Key points
- The three-day contest ended with researchers demonstrating 98 zero-day flaws and earning $1,262,000 in total.
- Ikotas Labs placed first with 42.5 Master of Pwn points and $361,000 in prizes.
- Researchers repeatedly compromised the Samsung Galaxy S26; teams also demonstrated attacks against the Google Pixel 10.
- Twenty-nine teams targeted products across seven categories, including mobile devices, AI systems, messaging apps, printers, and wellness healthcare devices.
- The contest requires targets to run the latest firmware and contestants to demonstrate arbitrary code execution.
- Vendors have 90 days to patch flaws disclosed during the contest before ZDI publicly shares details.
Article Details
- Event Type
- Pwn2Own Ireland 2026 hacking contest concluded, with competitors demonstrating zero-day vulnerabilities against products across multiple categories.
- Impact
- Competitors exploited 98 zero-day flaws and received $1,262,000 in rewards. Demonstrations included attacks on the Samsung Galaxy S26, Google Pixel 10, OpenAI Codex, and Oracle Autonomous AI Database. Vendors are required to patch disclosed flaws within 90 days before ZDI publicly shares details.
People
Dimitrios ValsamarasCENSUS Labs team member who participated in a Galaxy S26 demonstration.Ken GannonCENSUS Labs team member who participated in a Galaxy S26 demonstration.Kyeongmin KimKAIST Hacking Lab participant in a team that demonstrated attacks on the Galaxy S26.Mikko HyppönenNamed speaker in an advertisement for a digital security summit.Nguyen Thanh DatViettel Cyber Security representative who participated in hacking the Samsung Galaxy S26.Tenia ValsamaraCENSUS Labs team member who participated in a Galaxy S26 demonstration.
Vendors
AppleApple's iPhone 17 was also a potential target, with a maximum award of $300,000 for a remote hack, but no contestant registered for an attempt.GoogleThey also collected the competition's top reward of $300,000 on the third day after chaining multiple zero-days to hack the Google Pixel 10.OpenAIMaster of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.Oracle$361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.Samsungedition with 42.5 Master of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.Trend MicroTrend Micro's Zero Day Initiative (ZDI) organizes the competition to identify zero-day flaws before attackers exploit them in the wild.
Products
Apple iPhone 17Google Pixel 10They also collected the competition's top reward of $300,000 on the third day after chaining multiple zero-days to hack the Google Pixel 10.OpenAI Codexof Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.Oracle Autonomous AI Databaseearned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.Samsung Galaxy S26with 42.5 Master of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.