Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland

During the Pwn2Own Ireland 2026 contest, 29 research teams demonstrated exploits for 98 zero-day vulnerabilities in various products including mobile phones (Samsung Galaxy S26, Google Pixel 10), AI coding apps, and smart home devices. The contest is organized by Trend Micro's Zero Day Initiative (ZDI) to proactively identify and disclose zero-day flaws to vendors for patching. Vendors are obligated to patch these vulnerabilities within 90 days of disclosure. The event highlighted multiple chained exploits and repeated successful compromises of flagship devices. No evidence of these zero-days being exploited in the wild has been reported.

The vulnerabilities demonstrated during the contest represent critical security flaws that could allow arbitrary code execution on targeted devices and applications. However, these zero-days were disclosed responsibly to vendors who are required to patch them within 90 days. There is no indication that these vulnerabilities are currently exploited in the wild. The contest helps improve security by identifying and remediating unknown vulnerabilities before malicious actors can exploit them.

Vendors are required to patch all zero-day vulnerabilities disclosed during the Pwn2Own contest within 90 days. Organizations should monitor vendor advisories and apply patches promptly once released. Since the contest mandates the use of the latest firmware versions, ensuring devices are updated regularly is a key mitigation step. No immediate action is required beyond applying official patches when available.