Researchers exploit 45 zero-days at Pwn2Own Ireland 2026

Security researchers exploited 45 unique zero-day vulnerabilities on the second day of Pwn2Own Ireland 2026, collecting $232,500 in cash awards, according to a report by BleepingComputer. The event highlighted significant security gaps in current consumer technology, with the Samsung Galaxy S26 being successfully hacked three more times during the proceedings.

The competition, which challenges ethical hackers to breach hardened software and hardware targets, resulted in substantial payouts for the identified flaws. The $232,500 in awards reflects the cumulative value of the 45 distinct zero-day vulnerabilities discovered by the participating teams. These exploits demonstrate the ongoing difficulty in securing complex mobile operating systems and applications against sophisticated attack chains.

Context and Background

Pwn2Own is a series of hacking competitions organized by the Zero Day Initiative, where security researchers attempt to exploit vulnerabilities in widely used software and hardware. The Ireland 2026 edition serves as a critical testing ground for identifying weaknesses before they can be leveraged by malicious actors in the wild. The high number of successful exploits on the second day indicates that the targeted systems remained vulnerable despite previous security hardening efforts.

The inclusion of the Samsung Galaxy S26 in the competition underscores the vendor's commitment to transparency and security improvement through third-party auditing. However, the fact that the device was hacked three additional times suggests that previous patches or security measures were insufficient against the specific attack vectors employed by the researchers. These competitions often reveal zero-day flaws that vendors are unaware of until they are publicly demonstrated.

Who is Affected

Users of the Samsung Galaxy S26 are the primary group affected by the specific exploits demonstrated at this event. As the device was successfully compromised multiple times, owners of this specific model may be exposed to risks associated with the 45 unique vulnerabilities identified. The implications extend beyond just Samsung users, as the techniques used to chain these exploits could potentially be adapted for other platforms or devices with similar architectural vulnerabilities.

The broader technology sector is also impacted by the revelation of these zero-day flaws. The high count of successful hacks at a single event suggests that supply chain security and software development lifecycles may need re-evaluation across the industry. Organizations that deploy these devices for corporate use should assess their exposure, particularly if the devices handle sensitive data or connect to internal networks.

What should you do?

Security professionals should monitor vendor announcements for patches related to the vulnerabilities disclosed at Pwn2Own Ireland 2026. Users of the affected Samsung Galaxy S26 should remain vigilant for official security updates from the manufacturer. It is important to keep device firmware and applications up to date to mitigate the risk of exploitation. Organizations should review their device management policies to ensure that compromised devices can be quickly isolated or wiped if necessary.

What to do and how to stay safe: Samsung Galaxy S26

• Monitor official channels from device manufacturers for security patches addressing the disclosed zero-day vulnerabilities.
• Ensure that all mobile devices are running the latest available firmware versions to reduce exposure to known exploits.
• Review mobile device management policies to enforce strict security controls on corporate-owned hardware.
• Watch for public disclosures or advisories regarding the specific attack chains used in the Pwn2Own competition.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many zero-day vulnerabilities were found at Pwn2Own Ireland 2026?

Security researchers exploited 45 unique zero-day vulnerabilities during the second day of the event.

What was the total cash prize awarded at the competition?

The security teams collected a total of $232,500 in cash awards for their findings.

Which device was hacked multiple times during the event?

The Samsung Galaxy S26 was successfully hacked three more times during the competition.