Cybersecurity
Samsung Galaxy S26 hacked three times at Pwn2Own Ireland
On the second day of Pwn2Own Ireland 2026, security researchers won cash for 45 zero-day bugs, including three separate compromises of Samsung’s Galaxy S26 and other device hacks.
- Researchers collected $232,500 on the second day of Pwn2Own Ireland 2026 after demonstrating 45 unique zero-day vulnerabilities.
- Samsung's Galaxy S26 was hacked three times by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and a team including Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara.
- Jack Dates of RET2 Systems showed a Sonos Era 300 exploit chain in less than a minute, and HaeJung Yang of Out of Bounds won $40,000 for hacking Dynamo.
- Trend Micro's Zero Day Initiative organised the contest, which required fully patched devices and arbitrary code execution, and vendors had 90 days to patch disclosed flaws before publication.
Researchers collected $232,500 on the second day of Pwn2Own Ireland 2026 after demonstrating 45 unique zero-day vulnerabilities. Samsung's Galaxy S26 was breached three times during the session.
KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and a team including Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara each succeeded against the phone. Jack Dates of RET2 Systems also showed an exploit chain against a Sonos Era 300, while HaeJung Yang of Out of Bounds won $40,000 for hacking Dynamo.
PetoWorks, alongside other researchers, also compromised Home Assistant Green, and Ikotas Labs breached Oracle Autonomous AI Database with a seven-chain exploit. Another USB-based attempt was withdrawn before the second day began.
Trend Micro's Zero Day Initiative ran the event under rules that required the latest firmware and a demonstration of arbitrary code execution. It said vendors had 90 days to fix disclosed bugs before public release, and VinSOC had led the first day with chains against Oracle Autonomous AI Database and Philips Hue Bridge Pro.
Named in this story
People
- Kyeongmin Kim
- hacked the Samsung phone and withdrew one attack attempt
- Dimitrios Valsamaras
- was part of one team that hacked the Samsung phone
- Ken Gannon
- was part of one team that hacked the Samsung phone
- Tenia Valsamara
- was part of one team that hacked the Samsung phone
- Jack Dates
- demonstrated an exploit chain against the Sonos speaker
- HaeJung Yang
- won $40,000 for hacking Dynamo
Organisations
- Pwn2Own Ireland 2026
- the competition in which researchers targeted patched devices
- Trend Micro's Zero Day Initiative
- the group that organised the contest and disclosed bugs after the patch window
- KAIST Hacking Lab
- the lab behind Kyeongmin Kim
- PetoWorks
- successfully hacked the Samsung phone and Home Assistant Green
- RET2 Systems
- the company Jack Dates represented
- Out of Bounds
- the team that included HaeJung Yang
- Ikotas Labs
- breached Oracle Autonomous AI Database
- VinSOC
- topped the first-day leaderboard with exploit chains against two targets
Products and systems
- Samsung Galaxy S26
- was hacked three times on the second day and again on the first day
- Sonos Era 300
- was exploited in under a minute
- Dynamo
- was targeted in the AI Infrastructure category
- Home Assistant Green
- was hacked by multiple researchers
- Oracle Autonomous AI Database
- was breached with a multi-chain zero-day exploit
- Philips Hue Bridge Pro
- was one of VinSOC's day-one targets
How the source tells it
The report was mostly flat, though it ended with a promotional sign-up pitch unrelated to the competition.
- promotion the final paragraph shifted from reporting into a registration pitch