Cybersecurity
Pwn2Own Ireland hackers win $1.262m for 98 zero-days
Pwn2Own Ireland 2026 ended with 98 zero-day demonstrations and $1,262,000 in prize money, as Ikotas Labs led the table after hacks against Samsung, OpenAI and Oracle targets.
- The contest ended with $1,262,000 paid out after competitors demonstrated 98 zero-day flaws.
- Ikotas Labs finished first with 42.5 Master of Pwn points and $361,000 after hacking Samsung Galaxy S26, OpenAI Codex and Oracle Autonomous AI Database.
- Ikotas Labs also won the $300,000 top reward on the third day after chaining multiple zero-days to hack Google Pixel 10.
- Xint finished second with $240,000 and 27.5 Master of Pwn points, while Team ZyGoat finished third with $125,000 and 27.5 points.
- Trend Micro's Zero Day Initiative ran the contest, 29 teams targeted seven categories, and Apple's iPhone 17 drew no attempt.
Pwn2Own Ireland 2026 finished after three days with $1,262,000 awarded and 98 zero-days demonstrated. Ikotas Labs led the table with 42.5 Master of Pwn points and $361,000 after hacks against Samsung Galaxy S26, OpenAI Codex and Oracle Autonomous AI Database.
Ikotas Labs also took the contest's largest single award, $300,000, after chaining multiple flaws to compromise Google Pixel 10 on the third day. Xint finished second with $240,000 and 27.5 points, while Team ZyGoat finished third with $125,000 and 27.5 points.
On day one, Interrupt Labs, Ikotas Labs and Nguyen Thanh Dat of Viettel Cyber Security hacked Samsung Galaxy S26, although Samsung already knew some of the bugs used. Competitors collected $388,500 for 32 unique zero-days that day.
Day two produced $232,500 for 45 unique zero-day vulnerabilities, and the final day saw 21 zero-days and $641,000 in awards. The event covered seven categories, including mobile phones, AI infrastructure, AI coding apps, messaging apps, smart home devices, printers and wellness healthcare devices.
Apple's iPhone 17 carried a maximum $300,000 remote-hack reward, but no one registered to try it. Trend Micro's Zero Day Initiative organised the competition and said vendors had 90 days to patch disclosed flaws before details were published.
Named in this story
People
- Nguyen Thanh Dat
- joined the day-one hack of the Samsung Galaxy S26
- Kyeongmin Kim
- took part in the day-two hack of the Samsung Galaxy S26
- Dimitrios Valsamaras
- took part in the day-two hack of the Samsung Galaxy S26
- Ken Gannon
- took part in the day-two hack of the Samsung Galaxy S26
- Tenia Valsamara
- took part in the day-two hack of the Samsung Galaxy S26
Companies
- Trend Micro
- owned the Zero Day Initiative that organised the contest
- Samsung
- was the vendor whose Galaxy S26 was repeatedly hacked
Organisations
- Zero Day Initiative (ZDI)
- ran the competition and managed disclosure
- Ikotas Labs
- won the contest and took the top prize haul
- Xint
- finished second in the standings
- Team ZyGoat
- finished third in the standings
- Interrupt Labs
- helped hack the Samsung Galaxy S26 on day one
- Viettel Cyber Security
- was the affiliation of Nguyen Thanh Dat
- PetoWorks
- helped hack the Samsung Galaxy S26 on day two
- KAIST Hacking Lab
- was the affiliation of Kyeongmin Kim
- CENSUS Labs
- fielded a team that hacked the Samsung Galaxy S26 again
Products and systems
- Samsung Galaxy S26
- was hacked on multiple days of the contest
- OpenAI Codex
- was one of the targets Ikotas Labs hacked
- Oracle Autonomous AI Database
- was one of the targets Ikotas Labs hacked
- Google Pixel 10
- was the target of the largest single award
- Apple's iPhone 17
- was offered as a target but drew no attempt
How the source tells it
Mostly neutral contest reporting, but it used winner-and-prize framing and ended with an unrelated promotional plug.
- competitive triumph leaderboard placements and prize totals cast the contest as a winners’ race
- vendor boosterism the closing lines switched to a sign-up pitch for another summit