Samsung Galaxy S26 Hacked Three More Times at Pwn2Own Ireland

Security researchers exploited the Samsung Galaxy S26 three times on the second day of Pwn2Own Ireland 2026, according to BleepingComputer’s report on the competition.

The day’s contestants collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. The Galaxy S26 was compromised by Kyeongmin Kim of KAIST Hacking Lab, PetoWorks, and Dimitrios Valsamaras and Ken Gannon of Mobile Hacking Lab.

Other reported demonstrations included a Sonos Era 300 exploit chain by Jack Dates of RET2 Systems, completed in under a minute, and an award of $40,000 to HaeJung Yang of Out of Bounds for hacking Dynamo in the AI Infrastructure category. Researchers also hacked the Home Assistant Green smart home hub, while Ikotas Labs breached the Oracle Autonomous AI Database with a seven-chain zero-day exploit.

Before the second day began, Kim withdrew his attempt at a USB-based attack against the Google Pixel 10. Pwn2Own is organized by Trend Micro’s Zero Day Initiative (ZDI). Under the competition’s rules, devices run the latest firmware versions, and contestants must compromise a target and demonstrate arbitrary code execution. Vendors have 90 days to patch exploited zero-days before ZDI publicly discloses them.

The report says the contest covers seven categories. Researchers had also hacked the Galaxy S26 on day one, although some bugs used were already known to Samsung.