Clarissa Hana
The Pwn2Own Ireland 2026 hacking competition, a premier event for discovering and demonstrating previously unknown security vulnerabilities, has concluded, leaving a trail of impressive achievements and substantial reward payouts. Over the course of three intense days, security researchers collectively earned a staggering $1,262,000 by successfully exploiting 98 distinct zero-day flaws across a diverse array of cutting-edge technologies. This year’s event, held in Ireland, underscored the ever-evolving landscape of cybersecurity threats and the critical role of independent security research in fortifying digital defenses.
Ikotas Labs Dominates with Master of Pwn Title and Major Earnings
Emerging as the undisputed champions of Pwn2Own Ireland 2026, the team from Ikotas Labs showcased exceptional skill and strategic prowess. They amassed an impressive 42.5 Master of Pwn points, solidifying their top position. Their impressive performance translated into a significant financial reward of $361,000, earned through a series of sophisticated attacks targeting high-profile technologies including the Samsung Galaxy S26 smartphone, OpenAI’s Codex AI model, and the Oracle Autonomous AI Database.
The pinnacle of Ikotas Labs’ success arrived on the final day of the competition, where they secured the event’s largest single payout of $300,000. This substantial reward was a testament to their ability to chain multiple zero-day vulnerabilities together, culminating in a successful hack of the Google Pixel 10 smartphone. This demonstration of advanced exploit development highlights the complex and multi-layered nature of modern cybersecurity challenges.
Runners-Up and Notable Performances
Following closely behind Ikotas Labs, the formidable team Xint secured second place, demonstrating their significant cybersecurity expertise. Xint’s researchers were awarded $240,000 and accumulated 27.5 Master of Pwn points, showcasing their capability to uncover and exploit critical vulnerabilities. In third place, Team ZyGoat also demonstrated remarkable skill, earning $125,000 in prize money and matching Xint’s score of 27.5 Master of Pwn points. The close competition among the top contenders underscores the high caliber of talent present at Pwn2Own Ireland 2026.
Day-by-Day Breakdown: A Chronology of Exploits
The three-day event unfolded as a meticulously orchestrated battleground of innovation and defense, with each day revealing new vulnerabilities and rewarding skilled researchers.
Day 1: Initial Strikes and Vendor Awareness
The opening day of Pwn2Own Ireland 2026 saw immediate and impactful demonstrations of zero-day exploits. Security researchers from Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security successfully compromised the Samsung Galaxy S26 flagship device. While these exploits were significant, it was noted that the vendor, Samsung, was already aware of some of the vulnerabilities exploited. Despite this prior knowledge, the demonstration still contributed to the overall tally of discovered flaws. On this first day, competitors collectively earned $388,500 by exploiting 32 zero-day vulnerabilities, setting a high bar for the remainder of the contest. This early success highlighted the persistent challenges in securing even the most advanced mobile devices.
Day 2: Sustained Pressure and Diverse Targets
The second day of Pwn2Own Ireland 2026 witnessed continued offensive operations, with participants earning $232,500 in cash awards for uncovering 45 unique zero-day vulnerabilities. A particular highlight of the day involved multiple successful attacks against the Samsung Galaxy S26. PetoWorks, Kyeongmin Kim from KAIST Hacking Lab, and a collaborative team comprising Dimitrios Valsamaras, Ken Gannon, and Tenia Valsamara from CENSUS Labs, all managed to exploit the device again, demonstrating its susceptibility to different attack vectors. This sustained pressure on a single device underscored the difficulty vendors face in patching all potential weaknesses.
Day 3: Grand Finale and Record-Breaking Payouts
The final day of Pwn2Own Ireland 2026 proved to be the most lucrative, with security researchers exploiting 21 zero-days and earning a substantial $641,000 in cash. The day’s exploits included further successful rootings of the Samsung Galaxy S26, as well as multiple successful compromises of the Google Pixel 10. The significant payouts on the final day reflect the increasing complexity and value of the vulnerabilities discovered as the competition neared its conclusion.
Expanding the Scope: New Categories and Unattempted Targets
Pwn2Own Ireland 2026 expanded its horizons by featuring a wider array of technology categories for researchers to target. In total, 29 research teams engaged with products across seven distinct categories:
- Mobile Phones: Including the Samsung Galaxy S26 and the Google Pixel 10.
- AI Infrastructure: Targeting the underlying systems that power artificial intelligence.
- AI Coding Applications: Focusing on vulnerabilities within tools used for AI development.
- Messaging Applications: Assessing the security of popular communication platforms.
- Smart Home Devices: Investigating the security of connected household devices.
- Printers: Examining potential exploits in office and home printing technology.
- Wellness Healthcare Devices: A new category introduced this year, focusing on the security of devices used for health monitoring and wellness.
Interestingly, Apple’s iPhone 17 was also listed as a potential target, with a substantial maximum award of $300,000 for a remote hack. However, no contestants registered to attempt exploits against the iPhone 17, which could be attributed to various factors, including the perceived difficulty of finding zero-days for this specific device or the strategic focus of teams on other, potentially more accessible, targets.
The Mission of Pwn2Own: Proactive Security Through Disclosure
The Pwn2Own competition series is organized by Trend Micro’s Zero Day Initiative (ZDI), a leading vendor-neutral bug bounty program. The fundamental objective of Pwn2Own is to proactively identify zero-day flaws – vulnerabilities that are unknown to the vendor and the public – before malicious actors can exploit them in the wild. This proactive approach is crucial for improving overall cybersecurity.
The rules governing Pwn2Own are stringent, ensuring that the demonstrated exploits are as realistic as possible. A key requirement is that all devices and products participating in the contest must be running the latest available firmware versions. This ensures that researchers are not exploiting outdated or unpatched systems. Contestants are tasked with not only compromising the target but also demonstrating arbitrary code execution, a critical step in proving the exploit’s potential for malicious use.
A crucial element of the Pwn2Own framework is the vendor disclosure policy. Following the discovery and demonstration of a zero-day vulnerability, vendors are given a 90-day window to develop and deploy a patch. Only after this period, or if a patch is not provided within the stipulated timeframe, does ZDI publicly share details about the discovered flaws. This structured approach allows for responsible disclosure, giving vendors ample opportunity to protect their users while ultimately benefiting the wider cybersecurity community.
A Look Back: Pwn2Own Ireland 2025 Highlights
To contextualize the achievements of Pwn2Own Ireland 2026, it is informative to consider the previous year’s event. In Pwn2Own Ireland 2025, hackers demonstrated 73 zero-day flaws, earning a considerable $1,024,750 in rewards. The winning team of that year, Summoning Team, collected $187,500 after successfully hacking several high-profile devices, including the Samsung Galaxy S25, the Home Assistant Green, the QNAP TS-453E NAS, and multiple Synology devices. This comparison illustrates a trend of increasing zero-day discoveries and escalating reward payouts, suggesting a growing complexity in the cybersecurity landscape and a corresponding increase in the value placed on identifying these critical vulnerabilities.
The sheer volume of zero-day exploits discovered and demonstrated at Pwn2Own Ireland 2026, coupled with the substantial financial incentives, underscores the critical importance of continuous security research and proactive vulnerability management. The event serves as a vital platform for ethical hackers to showcase their expertise, pushing the boundaries of what is possible in cybersecurity and ultimately contributing to a more secure digital world for everyone. The findings from this year’s competition will undoubtedly inform future security strategies and development efforts across the technology industry.
