Loading story…
Researchers earned $388,500 for exploiting 32 reported unique zero-day vulnerabilities on the opening day of Pwn2Own Ireland 2026. Successful demonstrations targeted the Samsung Galaxy S26, OpenAI Codex, LiteLLM, Oracle Autonomous AI Database, smart home devices and printers. VinSOC led the leaderboard with $80,000 earned through exploit chains against the Philips Hue Bridge Pro and Oracle Autonomous AI Database. Other results included an argument-injection vulnerability in Codex and a four-vulnerability chain compromising the Sonos Era 300. Attempts against Google Pixel 10 and Chroma failed within the contest time limit.
Some successful exploit chains incorporated flaws already known to vendors, resulting in reduced payouts. These were controlled contest demonstrations, not evidence of attacks against real users. Organizer Zero Day Initiative gives vendors 90 days to release security updates before public disclosure; full exploit details, affected versions and a CVE identifier for the Codex flaw were not published. Organizations using the demonstrated products should monitor vendor advisories and prioritize applicable updates as they become available.
Track how attackers are adapting to this technology.
22 events from the most recent confirmed update back to the earliest known activity.
Researchers earned $232,500 for exploiting 45 unique zero-days on Pwn2Own Ireland's second day, with Galaxy S26 successes by Kyeongmin Kim, PetoWorks, and a team comprising Dimitrios Valsamaras, Ken Gannon, and Tenia Valsamara. Other new demonstrations included RET2 Systems' Sonos Era 300 exploit, Out of Bounds' $40,000 Dynamo hack, Ikotas Labs' seven-zero-day Oracle Autonomous AI Database chain, and additional Home Assistant Green compromises.
Yves Bieri of Xint successfully demonstrated an exploit against Home Assistant Green during Pwn2Own Ireland 2026's second day, earning $30,000 and three Master of Pwn points. The reference did not disclose vulnerability classes or exploit-chain details.
Researchers reportedly exploited 32 unique zero-day vulnerabilities and earned $388,500 during the opening day of Pwn2Own Ireland 2026. VinSOC researchers Vũ Chí Thành and Huỳnh Đức Tin topped the day-one leaderboard with $80,000 in awards.
VinSOC exploited Sonos Era 300 using two vulnerabilities for $17,500; Out of Bounds and Xint separately exploited Philips Hue Bridge Pro using five vulnerabilities each, earning $12,000 and $6,000 respectively. Ikotas Labs' Brother MFC-L8970CDW attempt, Team T-X Lab's Lexmark CX532adwe attempt, and Summoning Team researcher Aaron Christophel's Garmin Index BPM attempt all exceeded the allotted time without success.
Interrupt Labs combined an out-of-bounds read with an out-of-bounds write against the Garmin Index BPM wellness device, earning $20,000.
Researchers successfully hacked the Canon imageFORCE 1643F multifunction printer during the opening day of Pwn2Own Ireland 2026.
Sina Kheirkhah of Summoning Team successfully demonstrated a separate exploit against the Lexmark CX532adwe printer.
Thanh Do of Team Confused successfully demonstrated an attack against the Lexmark CX532adwe multifunction printer.
McCaulay Hudson successfully exploited the Sonos Era 300 smart speaker, earning $50,000. The reported exploit included an out-of-bounds write and a format string flaw.
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC exploited the Philips Hue Bridge Pro smart lighting hub using seven zero-day vulnerabilities. The demonstration earned $40,000.
VinSOC's separate attempt against Chroma did not succeed before the contest time limit expired.
VinSOC researchers chained five vulnerabilities to successfully exploit Oracle Autonomous AI Database, earning $40,000.
Out of Bounds exploited LiteLLM with a four-vulnerability chain that included two previously known flaws. The team received $15,000.
Taisic Yun of Xint combined improper input validation with code injection to obtain a reverse shell on LiteLLM, earning $40,000.
Ikotas Labs compromised the OpenAI Codex cloud-based coding agent through a single argument-injection vulnerability, earning $40,000. ZDI's day-one report did not disclose full exploit steps, affected versions, or a CVE identifier.
Mikhail Evdokimov, Polina Smirnova, and Mate Zombor of White Noise Club could not complete their Google Pixel 10 exploit within the contest's allotted time.
Ikotas Labs demonstrated a four-bug chain containing three new vulnerabilities and one flaw Samsung already knew about but had not patched. The team earned $11,000.
Interrupt Labs successfully exploited the Samsung Galaxy S26 using one zero-day and three previously reported vulnerabilities. The team received a reduced award of $15,750 because of the overlapping discoveries.
Nguyen Thanh Dat of Viettel Cyber Security demonstrated a four-bug exploit chain combining one new vulnerability with three vendor-known flaws, earning $31,250.
Pwn2Own Ireland 2026 concluded after three days with researchers earning $1,262,000 for demonstrating 98 zero-day vulnerabilities; the third day contributed $641,000 and 21 zero-days. Ikotas Labs finished first with $361,000 and 42.5 Master of Pwn points, followed by Xint with $240,000 and Team ZyGoat with $125,000.
FuzzingLabs exploited the Brother MFC-L8970CDW with a single zero-day, while Team DDOS compromised Home Assistant Green, Platform Security exploited Oracle Autonomous AI Database, Summoning Team compromised the Canon imageFORCE 1643F, and @_McCaulay exploited Philips Hue Bridge Pro. Ikotas Labs was declared Master of Pwn after its $300,000 Google Pixel 10 exploit moved it to the top of the leaderboard.
Ikotas Labs earned $300,000 for chaining multiple bugs to remotely compromise a Google Pixel 10. Tim Becker and Yves Bieri received $150,000, while Dimitrios Valsamaras and Ken Gannon earned $112,500 for separate Pixel exploits, with both awards reduced because their chains included previously known vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
14 references tracked. Mallory keeps watching after this page renders.
fuzzinglabs.com
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcezerodayinitiative.com
Open sourcetrendmicro.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Pwn2Own Ireland 2025 demonstrated 56 unique zero-day vulnerabilities across a range of consumer devices on the second day of the competition, earning a total of $792,750 in rewards. Notable exploits included a major Samsung Galaxy S25 compromise by The Summoning Team and Mobile Hacking Lab, who chained five vulnerabilities to achieve their result, as well as successful attacks against QNAP TS-453E, Synology DS925+, Canon imageCLASS MF654Cdw printer, Home Automation Green, and Phillips Hue Bridge. The event featured participation from leading teams and individuals, with The Summoning Team leading the scoreboard after their Samsung Galaxy exploit, and other teams such as CyCraft, Verichains, and Qrious Secure also earning significant rewards for their discoveries. The competition, sponsored by Meta, Synology, and QNAP, covered eight categories including flagship smartphones, printers, network storage, home networking gear, messaging apps, smart home and surveillance devices, and wearables. Vendors now have 90 days to address the vulnerabilities before public disclosure. Some exploits, such as the Synology BeeStation Plus, were ruled out of scope for the competition. The event highlights the ongoing risks posed by zero-day vulnerabilities in widely used consumer and enterprise devices, emphasizing the importance of coordinated vulnerability disclosure and rapid patching by vendors.
Jun 29, 2026
On the first day of Pwn2Own Ireland 2025, security researchers demonstrated the exploitation of 34 unique zero-day vulnerabilities across a wide range of consumer and enterprise devices. The event, organized by Trend Micro's Zero Day Initiative (ZDI), awarded a total of $522,500 in cash prizes to participating teams and individuals for their successful exploits. One of the most notable achievements was by Team DDOS, who chained eight zero-day vulnerabilities to compromise the QNAP Qhora-322 Ethernet wireless router via its WAN interface and subsequently gained access to a QNAP TS-453E NAS device, earning them $100,000 and 8 Master of Pwn points. Multiple teams, including Synacktiv, Summoning Team, DEVCORE, and Rapid7, achieved root-level code execution on devices such as the Synology BeeStation Plus, Synology DiskStation DS925+, QNAP TS-453E, and Home Assistant Green, each receiving $40,000 for their efforts. STARLabs, Team PetoWorks, Team ANHTUD, and Ierae researchers successfully exploited the Canon imageCLASS MF654Cdw multifunction laser printer in four separate attempts, highlighting the device's vulnerability. STARLabs also managed to hack the Sonos Era 300 smart speaker, earning $50,000, while Team ANHTUD exploited the Philips Hue Bridge for a $40,000 reward. The Summoning Team used a two-zero-day exploit chain to gain root on the Synology ActiveProtect Appliance DP320, securing an additional $50,000. By the end of the day, the Summoning Team led the Master of Pwn leaderboard with 11.5 points, closely followed by Team DDOS. The competition featured eight categories, including flagship smartphones, messaging apps, smart home devices, printers, and home networking equipment, with a total prize pool of up to $2,000,000 and a record $1,000,000 single prize for a 0-click WhatsApp exploit. The ZDI coordinates responsible disclosure with affected vendors, granting them 90 days to patch vulnerabilities before public disclosure. The event's schedule included a diverse set of targets and participants, with each attempt carefully timed and monitored. Technical details of the exploits ranged from stack-based and heap-based buffer overflows to complex exploit chains involving multiple zero-days. The competition not only showcased the skills of top security researchers but also contributed to improving the security posture of widely used devices. The responsible disclosure process ensures that vendors are alerted to critical vulnerabilities before they can be weaponized by malicious actors. The first day of Pwn2Own Ireland 2025 underscored the ongoing need for robust security research and proactive vulnerability management in the technology ecosystem. The event's results will drive future security updates and influence best practices across the industry. The high-profile nature of the competition and the significant financial incentives continue to attract elite researchers and teams from around the world.
Jun 29, 2026
Researchers at **Pwn2Own Berlin 2026** earned **$523,000** on the first day after demonstrating **24 unique zero-day vulnerabilities** against fully patched targets spanning browsers, operating systems, AI platforms, and NVIDIA-related infrastructure. The standout exploit came from **Orange Tsai** of **DEVCORE Research Team**, who chained **four logic bugs** to escape the **Microsoft Edge** sandbox and collected **$175,000**. **Windows 11** was also successfully compromised three times through separate local privilege-escalation zero-days, underscoring continued risk in core desktop platforms. Other successful demonstrations targeted **Red Hat Linux for Workstations**, **NVIDIA Container Toolkit**, **NVIDIA Megatron Bridge**, **LiteLLM**, **Chroma**, **OpenAI Codex**, and **LM Studio**, showing that enterprise AI tooling was a major attack surface at the event. Some attempts, including attacks against **Oracle Autonomous AI Database** and one **OpenAI Codex** entry, failed, but AI products still featured prominently as the competition’s enterprise-and-AI theme drove testing. After day one, **DEVCORE Research Team** led the standings with **$205,000**, and disclosed bugs now move into the contest’s **90-day vendor remediation window**.
Jun 29, 2026