Pwn2Own Ireland Day 1: Researchers Exploit 32 Zero-Days, Earning $388,500

First Day Exploits at Pwn2Own Ireland 2026

On the opening day of the Pwn2Own Ireland 2026 competition, security researchers successfully exploited 32 zero-day vulnerabilities across various devices. These exploits resulted in payouts totaling $388,500 for the participating teams.

Key targets included the Samsung Galaxy S26, which was hacked twice, as well as Lexmark and Canon multifunction printers. Researchers also compromised a Sonos Era 300 smart speaker and demonstrated zero-days in LiteLLM.

AI and Mobile Targets

The competition featured a range of categories, including mobile phones like the Apple iPhone 17, Samsung Galaxy S26, and Google Pixel 10. In the AI category, the OpenAI Codex cloud-based AI coding agent was taken down using a single argument-injection bug.

Teams like Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security were notable for their successful compromises of the Samsung Galaxy S26. Some exploited bugs were already known to the vendor.

Purpose of Pwn2Own

The Zero Day Initiative (ZDI) organizes the Pwn2Own hacking competition to proactively identify zero-day vulnerabilities. This process allows vendors to address security flaws before malicious actors can exploit them in the wild.

Following a successful exploit at Pwn2Own, vendors are given a 90-day window to release security updates. After this period, Trend Micro's ZDI publicly discloses the vulnerabilities.

Upcoming Competition Days

The competition is scheduled to continue with further attempts on devices in the AI infrastructure, printers, smart home, and wellness categories. The Samsung Galaxy S26 and Google Pixel 10 will also be targeted again on subsequent days.

Last year's Pwn2Own Ireland event saw researchers earn $1,024,750 for 73 zero-day flaws, with Summoning Team being a top earner for compromising various devices including the Samsung Galaxy S25 and several NAS systems.