Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

At Pwn2Own Ireland 2026, researchers demonstrated exploitation of 32 zero-day vulnerabilities on the first day, notably hacking the Samsung Galaxy S26 twice. Other targets included Philips Hue Bridge Pro, Oracle Autonomous AI Database, Lexmark and Canon multifunction printers, OpenAI Codex AI coding agent, and Sonos Era 300 smart speaker. Some vulnerabilities were previously known to vendors. The event is organized by ZDI, which coordinates responsible disclosure with a 90-day patch window post-exploit demonstration.

The exploitation of multiple zero-day vulnerabilities across a range of devices and platforms demonstrates significant security risks to affected products, including flagship mobile devices, smart home hubs, AI infrastructure, and printers. Successful exploitation could allow attackers to compromise device integrity and functionality. However, no active in-the-wild exploitation is reported. Vendors have a 90-day window to release patches following the event.

Vendors have 90 days from the Pwn2Own event to issue security updates addressing the disclosed zero-day vulnerabilities. Organizations should monitor vendor advisories and apply patches promptly once available. Since some bugs were already known to vendors, some mitigations may already be in place. No immediate action is required beyond applying forthcoming official patches.