Clarissa Hana
The second day of Pwn2Own Ireland 2026 concluded with a significant haul of security breakthroughs, as researchers successfully identified and exploited 45 unique zero-day vulnerabilities across a range of high-profile devices and software. This impressive display of offensive security expertise resulted in $232,500 in cash awards distributed to the participating teams and individuals. The event, a cornerstone in the cybersecurity calendar, continues to highlight the persistent vulnerabilities lurking within even the most advanced technological products, providing crucial intelligence for vendors to strengthen their defenses.
Samsung Galaxy S26 Faces Persistent Attacks
The flagship Samsung Galaxy S26 smartphone proved to be a particularly enticing target, with its security being breached on three separate occasions throughout the day. Kyeongmin Kim of KAIST Hacking Lab, the PetoWorks team, and the duo of Dimitrios Valsamaras and Ken Gannon from Mobile Hacking Lab each successfully demonstrated exploits against the device. These repeated successes underscore the complex security landscape of modern mobile operating systems and hardware, emphasizing the need for continuous vigilance and robust patching strategies from manufacturers. The awarding of significant prizes for these exploits directly incentivizes the discovery of flaws that could otherwise be exploited by malicious actors.
Smart Home and AI Infrastructure Under Scrutiny
Beyond mobile devices, the Pwn2Own Ireland 2026 competition delved into the rapidly expanding realms of smart home technology and artificial intelligence infrastructure. The Home Assistant Green smart home hub became the target of multiple successful attacks. Teams including PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and the Doyensec duo of Yassine Bengana and Maxence Schmitt all managed to compromise the device, showcasing a breadth of vulnerabilities within the popular home automation platform.
In the critical AI Infrastructure category, HaeJung Yang of the Out of Bounds team was awarded a substantial $40,000 for a sophisticated exploit targeting Dynamo. This achievement highlights the growing importance of securing the underlying infrastructure that powers artificial intelligence, a sector experiencing exponential growth and adoption across industries.
The Oracle Autonomous AI Database also fell victim to a sophisticated seven-chain zero-day exploit, demonstrated by Ikotas Labs. This breach of a core AI data management system is particularly noteworthy, given the sensitive nature of the data processed and the foundational role such databases play in AI development and deployment. The successful exploitation of a seven-chain exploit suggests a deep and intricate understanding of the database’s architecture and potential weaknesses.
Retrospective on Day One and Pre-Event Withdrawals
The momentum from the first day of Pwn2Own Ireland 2026 carried into the second, building upon the 32 zero-day vulnerabilities disclosed on the opening day, which yielded over $180,000 in awards. However, the competition is not without its adjustments. Notably, prior to the commencement of the second day’s activities, Kyeongmin Kim withdrew his planned attempt to exploit a USB-based vulnerability targeting the Google Pixel 10. While the reasons for such withdrawals are not always publicly detailed, they can stem from various factors, including last-minute technical challenges, a shift in strategic focus, or the discovery of alternative, more promising exploitation paths.
Pioneering the Discovery of Zero-Day Threats
Pwn2Own Ireland 2026, like its predecessors, is meticulously organized by Trend Micro’s Zero Day Initiative (ZDI). The primary objective of this renowned competition is to proactively identify and expose zero-day flaws in fully patched, commercially available devices and software before they can be leveraged by malicious actors in real-world cyberattacks. The rules of Pwn2Own are stringent: all participating devices must be running the latest available firmware and software updates. Contestants are tasked with not only compromising the target device but also demonstrating the ability to execute arbitrary code, a critical indicator of a serious security vulnerability.
A crucial element of the Pwn2Own process is the responsible disclosure protocol. Once a zero-day vulnerability is successfully exploited and demonstrated at the event, vendors are granted a 90-day window to develop and deploy patches. Following this disclosure period, the ZDI will publicly release details about the exploited vulnerabilities, thereby informing the broader security community and driving further improvements in defensive measures.
Comprehensive Target Categories and Evolving Landscape
The Pwn2Own Ireland 2026 competition encompasses a broad spectrum of cutting-edge technologies, divided into seven distinct categories. These include:
- Mobile Phones: Featuring prominent devices such as the Samsung Galaxy S26 and the Google Pixel 10.
- Messaging Applications: Targeting the security of popular communication platforms.
- Smart Home Devices: Including hubs like the Home Assistant Green and smart lighting systems.
- Printers: Addressing vulnerabilities in often-overlooked but critical office peripherals.
- AI Infrastructure: Focusing on the foundational systems powering artificial intelligence.
- AI Coding Applications: Examining the security of tools used for AI development.
- Wellness Healthcare Devices: A new category introduced for 2026, reflecting the increasing integration of technology in personal health monitoring.
Interestingly, Apple’s iPhone 17 was also listed as a potential target, with a substantial $300,000 award for a successful remote exploit. However, no contestants registered to attempt this challenge, indicating either a perceived high barrier to entry for exploiting the device or a strategic decision by researchers to focus on other targets.
Day One Recap: A Strong Start for Vulnerability Discovery
The first day of Pwn2Own Ireland 2026 set a high bar for the subsequent days, with researchers demonstrating 32 zero-day flaws. Among the notable successes was the Samsung Galaxy S26, which was also targeted on day one by Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security. However, it was noted that some of the vulnerabilities exploited on day one were already known to the vendor, a situation that Pwn2Own aims to minimize by focusing on previously undisclosed flaws.
The VinSOC team, Vé Chà nh and Huỳúnh Äức Tin, emerged as early leaders on day one. They were awarded $40,000 for a five-zero-day exploit chain targeting the Oracle Autonomous AI Database. Furthermore, they secured an additional $40,000 for successfully chaining seven zero-days to exploit a Philips Hue Bridge Pro smart lighting hub, showcasing remarkable skill in identifying and linking multiple vulnerabilities.
Looking Ahead: Day Three Promises Further Exploits
The competition is slated to continue with a packed schedule for day three. Researchers are expected to focus their efforts on a variety of smart home devices, AI infrastructure components, and printer systems. The Samsung Galaxy S26 and Google Pixel 10 smartphones will once again be targets, offering further opportunities for participants to demonstrate their prowess and for vendors to receive critical vulnerability data. The sustained focus on these high-demand devices suggests ongoing challenges in maintaining robust security across diverse technological ecosystems.
Comparative Performance: Pwn2Own Ireland 2025
To provide context for the current event’s scale and impact, it is instructive to look back at Pwn2Own Ireland 2025. In the previous year, hackers successfully demonstrated a staggering 73 zero-day flaws, earning a collective total of $1,024,750. The Summoning Team ultimately clinched the top spot, securing $187,500 after demonstrating exploits against the Samsung Galaxy S25, the Home Assistant Green, a QNAP TS-453E NAS, and multiple Synology devices. This historical data illustrates a consistent trend of significant vulnerability discovery and substantial financial rewards for security researchers at the Pwn2Own Ireland events, highlighting the enduring value of these competitions in advancing cybersecurity.
The findings from Pwn2Own Ireland 2026, particularly the sheer volume of unique zero-day vulnerabilities discovered and the diverse range of targeted devices, serve as a stark reminder of the ever-evolving threat landscape. The event underscores the critical role of proactive security research in identifying and mitigating risks before they can be exploited by malicious actors. As technology continues to advance at an unprecedented pace, events like Pwn2Own are indispensable for ensuring that the digital infrastructure upon which society relies remains secure and resilient against emerging cyber threats. The data generated by these competitions not only benefits the vendors whose products are targeted but also contributes to a safer digital environment for users worldwide. The ongoing efforts of the Zero Day Initiative and the participating researchers are vital in maintaining this crucial balance between innovation and security.
