Cybersecurity
Researchers exploit 32 zero-days at Pwn2Own Ireland
Security researchers on the first day of Pwn2Own Ireland 2026 collected $388,500 by exploiting 32 flaws across phones, printers, an AI coding agent and a smart speaker.
- The first day of Pwn2Own Ireland 2026 produced 32 zero-day exploits and $388,500 in awards.
- Interrupt Labs, Ikotas Labs and Nguyen Thanh Dat targeted Samsung’s Galaxy S26, and the article said some of the bugs were already known to the vendor.
- Researchers also demonstrated flaws in LiteLLM, Lexmark CX532adwe, Canon imageFORCE 1643F, OpenAI Codex and Sonos Era 300.
- Mikhail Evdokimov, Polina Smirnova and Mate Zombor of White Noise Club tried to exploit the Google Pixel 10 but did not finish in time.
- The Zero Day Initiative organised the contest and said vendors had 90 days to ship updates before public disclosure.
On the first day of Pwn2Own Ireland 2026, researchers exploited 32 zero-days and received $388,500 in prizes. The article said the contest covered mobile phones, printers, smart home devices, messaging apps, AI infrastructure, AI coding apps and wellness healthcare devices.
Interrupt Labs, Ikotas Labs and Nguyen Thanh Dat of Viettel Cyber Security targeted Samsung’s Galaxy S26. The article said some of the flaws used in those challenges were already known to the vendor.
Other teams showed flaws in LiteLLM and in the Lexmark CX532adwe and Canon imageFORCE 1643F printers. Researchers also used an argument-injection bug against OpenAI Codex and exploited four vulnerabilities in the Sonos Era 300.
Mikhail Evdokimov, Polina Smirnova and Mate Zombor of White Noise Club also worked against the Google Pixel 10, but their exploit did not complete within the time allowed. The Zero Day Initiative organised the competition and said vendors had 90 days to issue security updates before it disclosed the bugs publicly.
The article said the second and third days of the contest would bring further attempts against the same mobile phones, along with more targets in printers, smart home and AI infrastructure.
Named in this story
People
- Nguyen Thanh Dat
- a Viettel Cyber Security researcher who worked on the Samsung phone
- Mikhail Evdokimov
- a White Noise Club researcher who targeted the Pixel 10
- Polina Smirnova
- a White Noise Club researcher who targeted the Pixel 10
- Mate Zombor
- a White Noise Club researcher who targeted the Pixel 10
Companies
- Trend Micro
- the company named in connection with ZDI’s disclosure process
- Samsung
- the vendor of the Galaxy S26
- Interrupt Labs
- one of the groups that hacked the Samsung phone
- Ikotas Labs
- one of the groups that hacked the Samsung phone
- Viettel Cyber Security
- the team affiliation named for Nguyen Thanh Dat
Organisations
- Pwn2Own Ireland 2026
- the contest where researchers demonstrated the exploits
- Zero Day Initiative
- the organiser of the competition
- White Noise Club
- the team that tried to exploit the Google Pixel 10
Products and systems
- Samsung Galaxy S26
- the phone that researchers targeted and hacked twice
- LiteLLM
- one of the systems researchers exploited
- Lexmark CX532adwe
- one of the printers researchers hacked
- Canon imageFORCE 1643F
- one of the printers researchers hacked
- OpenAI Codex
- the AI coding agent that was taken down by an argument-injection bug
- Sonos Era 300
- the smart speaker that researchers compromised again
- Google Pixel 10
- the phone targeted by White Noise Club
How the source tells it
The piece was mostly straightforward contest reporting, but it used lightly promotional language and ended with an unrelated summit pitch.
- hype it framed the day’s results with celebratory labels and victory verbs
- promotion it closed with a marketing-style invitation that was not part of the news