SecOraLens
HighZero-Day

Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland

BleepingComputer·Source published ·1 min read

What happened?

The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. [...]

Key details

  • Ikotas Labs won with 42.5 Master of Pwn points and $361,000 by hacking Samsung Galaxy S26, OpenAI Codex, and Oracle Autonomous AI Database.
  • Ikotas Labs earned the top single reward of $300,000 on day three by chaining zero-days against Google Pixel 10.
  • Day two added 45 unique zero-days for $232,500, with Galaxy S26 compromised three more times.
  • Twenty-nine teams targeted seven categories: mobile phones, AI infrastructure, AI coding apps, messaging apps, smart home devices, printers, and wellness healthcare devices.

Affected

  • Oracle Autonomous AI Database

Fixes and mitigations

  1. Vendors must patch disclosed zero-days within 90 days before ZDI publishes details.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.