The Pwn2Own Ireland 2026 hacking competition has come to an end. Hackers have received $1,262,000 in rewards after exploiting 98 zero-day vulnerabilities.
Security researchers from Ikotas Labs won this year’s Pwn2Own Ireland edition with 42.5 Master of Pwn points and $361,000 earned over the three-day competition after hacking the Samsung Galaxy S26, OpenAI Codex and Oracle Autonomous AI Database.
On the third day after that, they also received the competition’s highest reward of $300,000 Chaining multiple zero days to hack the Google Pixel 10.
Xint took second place with $240,000 and 27.5 Master of Pwn points, while Team ZyGoat took third place with $125,000 in prize money and 27.5 Master of Pwn points.
Viettel Cyber Security’s Interrupt Labs, Ikotas Labs and Nguyen Thanh Dat hacked Samsung’s flagship Galaxy S26 on day one, but the provider already knew some of them the exploited bugs. In total, competitors raised $388,500 after proving 32 zero-day flaws.
On the second day, participants received $232,500 in cash prizes for 45 unique zero-day vulnerabilities. The highlight was PetoWorks, Kyeongmin Kim from KAIST Hacking Lab and a team consisting of Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara from CENSUS Labs, who paralyzed the Galaxy S26 three more times.
On the third dayHackers have rooted the Samsung Galaxy S26 again and disabled the Google Pixel 10 three times. In total, security researchers exploited 21 zero-days for $641,000 in cash on the final day of the competition today.
This year 29 research teams targeted products in seven categories: Mobile phones (Samsung Galaxy S26 and Google Pixel 10), AI infrastructure, AI coding apps, messaging apps, smart home devices, printers and a new category focused on wellness health devices.
Apple’s iPhone 17 was also a potential target, with a maximum prize of $300,000 for a remote hack, but no participants came forward to attempt it.
Trend Micro’s Zero Day Initiative (ZDI) is organizing the competition to identify zero-day vulnerabilities before attackers exploit them in the wild. Require Pwn2Own rules All devices and products must run the latest firmware versions, and participants must compromise the target and demonstrate arbitrary code execution.
Vendors must resolve zero-days disclosed during the Pwn2Own competition within 90 days before ZDI publicly releases details.
During Pwn2Own Ireland 2025, hackers demonstrated 73 zero-day vulnerabilities and earned $1,024,750. The Summoning Team won the competition and raised $187,500 after hacking the Samsung Galaxy S25, Home Assistant Green, QNAP TS-453E NAS, and several Synology devices.
