HighZero-Day
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
BleepingComputer·Source published ·1 min read
What happened?
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]
Key details
- First day saw 32 zero‑days exploited, Samsung Galaxy S26 hacked twice, $388,500 earned
- Seven zero‑days chained to compromise Philips Hue Bridge Pro smart lighting hub
- Five zero‑days chained to exploit Oracle Autonomous AI Database
- OpenAI Codex AI coding agent taken down via single argument‑injection bug
- Four vulnerabilities used to compromise Sonos Era 300 smart speaker again
- Vendors have 90 days to release patches before public disclosure
Affected
- Samsung Galaxy S26 was hacked twice
- Philips Hue Bridge Pro smart lighting hub exploited via seven zero‑days
- Oracle Autonomous AI Database hit by five zero‑day chain
- Lexmark CX532adwe and Canon imageFORCE 1643F printers compromised
- OpenAI Codex cloud AI coding agent compromised
- Sonos Era 300 smart speaker compromised via four vulnerabilities
Fixes and mitigations
- Vendors have 90 days to issue security updates before disclosure
What to look for
- Single argument‑injection bug used against OpenAI Codex
- Four‑vulnerability exploit chain against Sonos Era 300 speaker
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.