Hackers Claim $1,262,000 for 98 Zero-Days at Pwn2Own Ireland 2026

Researchers collected significant rewards for exploiting nearly one hundred unpatched vulnerabilities during the latest security competition.

Threat Times Exposure DeskOctober 9, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek black laptop sits on a polished conference table, its screen glowing with abstract geometric shapes. — AI-generated illustration: Threat Times

Key points

Hackers earned $1,262,000 in total rewards at Pwn2Own Ireland 2026.
Competitors successfully exploited 98 distinct zero-day vulnerabilities.
The event concluded with these findings, according to BleepingComputer.

Hackers collected $1,262,000 in rewards after exploiting 98 zero-day flaws at the Pwn2Own Ireland 2026 hacking contest, according to a report by BleepingComputer. The competition has now concluded, marking the final tally of successful exploits and payouts for this year's event.

The figure of $1,262,000 represents the total compensation awarded to researchers who demonstrated working exploits against software products during the contest. These payouts correspond to the 98 zero-day vulnerabilities that were successfully breached. The event serves as a high-stakes environment where security researchers prove the feasibility of attacks against real-world software before vendors are aware of the flaws.

Context and Background

Pwn2Own is a well-known series of hacking competitions organized by the Internet Security Systems group at the Center for Information Resilience at the University of British Columbia. The Ireland edition is part of the global circuit that tests the resilience of various software products, including browsers, operating systems, and virtualization platforms.

The success rate of 98 exploits indicates a challenging year for the software vendors whose products were targeted. Zero-day vulnerabilities are particularly dangerous because no patch exists at the time of discovery, leaving users exposed to potential exploitation. The substantial financial reward reflects the high value placed on these undisclosed flaws by the competition organizers and the participating vendors.

Who Is Affected

Software vendors whose products were targeted in the Pwn2Own Ireland 2026 contest are the primary entities affected by these findings. These organizations must now analyze the disclosed vulnerabilities and develop patches to address the security gaps.

Users of the affected software are also at risk until fixes are deployed. The 98 zero-days represent immediate security concerns for anyone running the unpatched versions of the compromised software. The specific products targeted are not detailed in the provided summary, but typically include major applications such as web browsers, PDF readers, and remote access tools.

What should you do?

Security teams should monitor official channels from software vendors for announcements regarding patches for vulnerabilities disclosed at Pwn2Own events. Organizations should prioritize applying updates as soon as they become available to mitigate the risk of exploitation.

What to do and how to stay safe: Pwn2Own

Monitor vendor security advisories for patches addressing vulnerabilities disclosed at recent hacking competitions.
Review current software versions against vendor release notes to identify if your systems are running affected builds.
Implement network segmentation to limit the potential impact of a successful exploit on critical assets.
Ensure endpoint detection and response tools are updated to recognize behaviors associated with known exploit techniques.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.