Pwn2Own Ireland Day One by the Numbers: 32 Zero-Days Across Phones, Printers and Smart Devices
Researchers at Pwn2Own Ireland 2026 exploited 32 zero-days on day one, hitting office printers, a smart lighting hub, an AI database and the Samsung Galaxy S26. Here is the scoreboard.
Every year, Pwn2Own pays researchers to break popular products before criminals do. The first day of the 2026 Ireland event produced a long list of successful attacks, and several of the targets are devices found in ordinary offices. Here is the day in numbers.
The scoreboard
- Zero-days exploited on day one: 32
- Prize money awarded: $388,500
- Target categories: Seven, covering mobile phones (Apple iPhone 17, Samsung Galaxy S26 and Google Pixel 10), printers, smart home devices, messaging apps, AI infrastructure, AI coding apps and, new this year, wellness healthcare devices
- Leaders after day one: Vũ Chí Thành and Huỳnh Đức Tin of VinSOC
Notable results
- Samsung Galaxy S26: Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security all targeted Samsung’s flagship, and the phone was hacked twice. Some of the bugs used were already known to the vendor.
- Philips Hue Bridge Pro: VinSOC chained seven zero-days against the smart lighting hub for $40,000.
- Oracle Autonomous AI Database: VinSOC earned another $40,000 with a chain of five zero-days.
- Office printers: Researchers compromised the Lexmark CX532adwe and the Canon imageFORCE 1643F multifunction printers.
- AI tools: Teams demonstrated LiteLLM zero-days and took down the OpenAI Codex cloud coding agent with a single argument-injection bug.
- Sonos Era 300: The smart speaker fell again, this time to four vulnerabilities.
- Google Pixel 10: A White Noise Club team could not get its exploit working within the time limit.
What happens next
- Days two and three bring more attempts on AI infrastructure, printers, smart home and wellness devices, along with the Galaxy S26 and Pixel 10.
- Trend Micro’s Zero Day Initiative, which runs the contest, gives vendors 90 days to release fixes before it discloses the flaws publicly.
- For comparison, last year’s Ireland event paid $1,024,750 for 73 zero-days. Summoning Team took $187,500 for hacking targets including the Galaxy S25, several Synology NAS and camera products, the Home Assistant Green and a QNAP NAS.
See Sergiu Gatlan’s day-one recap at BleepingComputer for the full leaderboard.
What this means for your company
- Printers and smart devices are computers. The multifunction printers and smart hubs hacked on stage are the kind found in many offices. Include them in your patch schedule and asset inventory.
- Watch for updates over the next 90 days. Vendors of the affected products should release fixes. Plan to apply them quickly when they arrive.
- Keep IoT off your main network. Put printers, speakers and lighting controllers on a separate network segment so a compromised device cannot reach business systems.
- Treat AI tools as infrastructure. AI gateways and coding agents were targets too. Apply the same access controls and update discipline you use for other servers.
Need help bringing printers, smart devices and other overlooked equipment under your security program? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
