Researchers exploit 32 zero-days on first day of Pwn2Own Ireland 2026

Security researchers exploited 32 zero-day vulnerabilities on the first day of Pwn2Own Ireland 2026, earning a total of $388,500, according to BleepingComputer.

The event’s first-day highlight was a successful hack of the Samsung Galaxy S26 by teams from Interrupt Labs, Ikotas Labs, and Viettel Cyber Security researcher Nguyen Thanh Dat. Some bugs used in the challenges were already known to the vendor.

Vũ Chí Thành and Huỳnh Đức Tin of VinSOC, who led the leaderboard, won $40,000 for chaining seven zero-days against a Philips Hue Bridge Pro smart lighting hub. They earned another $40,000 for a chain of five zero-days targeting Oracle Autonomous AI Database.

Researchers also demonstrated LiteLLM zero-days, compromised Lexmark and Canon multifunction printers, and took down OpenAI Codex with a single argument-injection bug. Four vulnerabilities were used to compromise a Sonos Era 300 speaker. A White Noise Club team attempted to hack the Google Pixel 10 but could not complete its exploit within the allotted time.

The Zero Day Initiative organizes the contest to find vulnerabilities before threat actors can exploit them. After a flaw is demonstrated, vendors have 90 days to release a security update before Trend Micro’s ZDI publicly discloses it.