The Samsung Galaxy S26 was successfully compromised three times on the second day of Pwn2Own Ireland 2026, following three separate Galaxy S26 compromises on the opening day. Researchers earned $232,500 on day two after demonstrating 45 distinct zero-day vulnerabilities across the competition.
Key Points
- KAIST Hacking Lab, PetoWorks, and Mobile Hacking Lab each compromised the Galaxy S26 on day two.
- The opening-day results listed 28 zero-days and $342,500 in awards, while the separate day-two tally listed 45 zero-days and $232,500.
- Researchers also breached Sonos, Home Assistant, Oracle, Philips Hue, LiteLLM, and other products.
- Vendors receive technical details and have 90 days to release fixes before the Zero Day Initiative publishes vulnerability information.
Trend Micro’s Zero Day Initiative (ZDI) organizes Pwn2Own Ireland, which began on October 6 in Cork and attracted more than 60 entries. The 2026 event covered seven categories: mobile phones, messaging applications, smart home devices, printers, AI infrastructure, AI coding applications, and wellness healthcare devices.
Kyeongmin Kim of KAIST Hacking Lab, PetoWorks, and Dimitrios Valsamaras and Ken Gannon of Mobile Hacking Lab each demonstrated a successful Galaxy S26 attack on the second day. Under the contest rules, targets run the latest production firmware, and a successful entry must compromise the device and achieve arbitrary code execution.
The opening-day results included three additional Galaxy S26 compromises. Nguyen Thanh Dat of Viettel Cyber Security used four bugs, including three that were already known to Samsung, and received $31,250 and 3.25 Master of Pwn points. Interrupt Labs used four bugs, including three collisions and one zero-day, earning $15,750 and 3.25 points.
Ikotas Labs combined four bugs against the Galaxy S26, including one already known to Samsung, and received $11,000 and 4.5 Master of Pwn points. ZDI noted that some vulnerabilities used during the earlier attempts were already known to Samsung, while the second-day attempts involved newly exposed flaws.
The two event updates reported separate daily totals. The opening-day results listed 28 zero-days and $342,500 in awards, with some payouts reduced because exploit chains included previously known vulnerabilities. The second-day results listed 45 distinct zero-days and $232,500 in awards. Under Pwn2Own rules, the organizer can award reduced payments for known vulnerabilities, also called collisions.
Other products were compromised
Jack Dates of RET2 Systems demonstrated a Sonos Era 300 exploit chain in under a minute. McCaulay Hudson, identified in the event coverage as _McCaulay and previously associated with NCC Group, combined an out-of-bounds write with a format-string vulnerability against the same product and received $50,000 and five Master of Pwn points.
Out of Bounds team member HaeJung Yang received $40,000 for hacking Dynamo in the AI Infrastructure category. Taisic Yun of Xint obtained a reverse shell on LiteLLM through improper input validation and code injection, earning $40,000 and four Master of Pwn points.
PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Yassine Bengana and Maxence Schmitt of Doyensec breached the Home Assistant Green smart home hub. Ikotas Labs also breached the Oracle Autonomous AI Database with a seven-vulnerability zero-day chain.
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC received $40,000 for a five-zero-day chain targeting the Oracle Autonomous AI Database and another $40,000 for chaining seven zero-days against a Philips Hue Bridge Pro smart lighting hub. Team Confused earned $20,000 after using a single use-after-free vulnerability against a Lexmark CX532adwe printer.
The Samsung Galaxy S26 and Google Pixel 10 were both mobile-phone targets. Kyeongmin Kim withdrew a planned USB-based attack against the Pixel 10 before the second day began, while Apple’s iPhone 17 was listed as a potential target with a maximum $300,000 award for a remote hack but had no registered attempt.
Vendors have 90 days to respond
Successful contestants must provide detailed exploit documentation, and the affected vendors receive the vulnerability information. ZDI gives vendors 90 days to develop and release patches before publicly disclosing the vulnerabilities and exploit details.
Additional attempts against the Galaxy S26 and Google Pixel 10 were scheduled for the third day of the event. Users and administrators must monitor security advisories from the affected vendors and apply relevant updates when fixes become available.
About the Author
