The inaugural day of Pwn2Own Ireland 2026 saw researchers from multiple teams successfully breach devices across mobile, networking, and smart home segments by chaining together 32 previously unknown flaws. The competition, which runs across three days, offers substantial bounties for demonstrating zero-day exploits before vendors can patch them.
Pwn2Own Ireland 2026 divides its targets into seven categories: smartphones including the Apple iPhone 17, Samsung Galaxy S26, and Google Pixel 10; printers; smart home devices; messaging applications; AI infrastructure; AI-powered coding tools; and a newly added wellness healthcare devices category.
Teams from Interrupt Labs, Ikotas Labs, and researcher Nguyen Thanh Dat of Viettel Cyber Security achieved one of the day's marquee results by compromising the Samsung Galaxy S26 twice, though some of the vulnerabilities they exploited had already been disclosed to the manufacturer.
Leading the leaderboard after day one, Vũ Chí Thành and Huỳnh Đức Tin of VinSOC earned $40,000 by chaining seven zero-days to compromise a Philips Hue Bridge Pro smart lighting controller. The same team collected an additional $40,000 for executing a five-vulnerability chain against the Oracle Autonomous AI Database.
Other successful demonstrations on the first day included exploits targeting the Lexmark CX532adwe and Canon imageFORCE 1643F multifunction printers, a single argument-injection vulnerability in the OpenAI Codex cloud-based AI coding agent, and four chained flaws affecting a Sonos Era 300 smart speaker. Researchers also presented zero-day findings in LiteLLM.
An attempt by Mikhail Evdokimov, Polina Smirnova, and Mate Zombor of White Noise Club to exploit the Google Pixel 10 did not succeed within the competition's time constraints.
Competition Structure and Disclosure Timeline
The Zero Day Initiative, which organizes Pwn2Own, uses the competition to surface critical flaws in consumer and enterprise products before malicious actors can weaponize them. Following successful demonstrations, vendors receive 90 days to develop and release patches before Trend Micro's ZDI publicly discloses the vulnerabilities.
Remaining Competition Days
Day two will feature additional attempts against AI infrastructure, printers, smart home devices, wellness healthcare equipment, and another round targeting the Samsung Galaxy S26 and Google Pixel 10.
The final day will include further exploitation attempts on the Google Pixel 10 and Samsung Galaxy S26, along with multiple devices in the smart home, AI infrastructure, and printer categories.
Prior Year Performance
Last year's Pwn2Own Ireland event generated $1,024,750 in total payouts for 73 zero-day discoveries. Summoning Team led that competition with $187,500 earned through successful exploits of the Samsung Galaxy S25, Synology DiskStation DS925+ NAS, Home Assistant Green, Synology ActiveProtect Appliance DP320 NAS, Synology CC400W camera, and QNAP TS-453E NAS.