Three teams broke into Google's flagship on fully patched software — and the fixes have a 90-day clock
October 9, 2026 — Pwn2Own Ireland 2026 has ended in Cork with more than $1.2 million paid to security researchers, and the richest target was the Google Pixel 10, whose exploits earned three teams over $560,000.
Image: Ethical hackers at a competition stage testing a smartphone, smart speaker, lighting hub and printer under a glowing shield hologram. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: Every device beaten in Cork was running current, fully patched software. The weaknesses were unknown to vendors until researchers proved them — and each company now has 90 days to ship fixes before details become public.
Table of Contents
- Key Facts
- Pixel 10 Takes the Biggest Cheques
- Three Days, Three Rising Totals
- Phones Were Only Part of the Target List
- Collisions: When a New Bug Is Already Known
- What Happens to the Flaws Now
- What This Means for Device Owners
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Event | Pwn2Own Ireland 2026, held in Cork from October 6 |
| Organizer | Trend Micro's Zero Day Initiative (ZDI) |
| Total payouts | More than $1.2 million across the whole contest |
| Top target | Google Pixel 10 — three teams earned over $560,000 |
| Top single award | $300,000 to Ikotas Labs for a remote Pixel 10 hack |
| Opening days | 32 zero-days for $388,500 on day one; 45 more for $232,500 on day two |
| Disclosure rule | Vendors get full exploit details and 90 days to release fixes |
| Untouched targets | No one attempted the iPhone 17 or WhatsApp, despite $300,000 prizes |
Pixel 10 Takes the Biggest Cheques
The Pixel 10 produced the largest payouts on the final day. Ikotas Labs earned the full $300,000 top prize by chaining several flaws to compromise the phone remotely.
That result also carried the Master of Pwn title, with ZDI crediting Ikotas Labs 30 points for the entry. Two other teams also beat the Pixel 10.
Tim Becker and Yves Bieri of Xint received $150,000, a reduced award because their chain relied on a flaw that was already known.
Dimitrios Valsamaras and Ken Gannon earned $112,500 for a chain combining one new flaw with one known vulnerability. Together, the three Pixel 10 results top $560,000.
Three Days, Three Rising Totals
The contest built steadily. Day one produced 32 zero-day vulnerabilities and $388,500 in awards, according to BleepingComputer.
Day two added 45 unique zero-days and $232,500, taking the running total to $621,000 for 77 unique zero-days — the figure ZDI used in its own day-two recap.
| Date | Event |
|---|---|
| October 6 | Day one: 32 zero-days exploited, $388,500 awarded |
| October 7 | Day two: 45 more zero-days, $232,500; running total $621,000 |
| October 8 | Day three: Pixel 10 falls three times, including the $300,000 remote hack |
| Final total | More than $1.2 million paid across all categories |
For context, last year's Ireland edition paid $1,024,750 for 73 zero-day flaws. This year's total passed that mark, driven by the high-value phone results on the last day.
Phones Were Only Part of the Target List
Newsroom Focus: The target list is the real story for everyday users. Researchers also attacked the devices inside homes and offices — products people rarely think of as computers.
The Samsung Galaxy S26 was compromised repeatedly, including three times on day two alone. A Sonos Era 300 exploit earned $50,000, and one day-two demonstration against that speaker model finished in under a minute.
Smart-home gear featured throughout. Chains against the Philips Hue Bridge Pro hub and the Home Assistant Green hub both earned awards, with one Hue entry chaining seven flaws.
Office hardware was not spared. $20,000 awards were paid against Lexmark and Brother printers — including a single-flaw break of the Brother MFC-L8970CDW by FuzzingLabs on day three — and for an exploit of the Garmin Index BPM blood pressure monitor in the new wellness category.
Enterprise and AI tooling rounded out the list, with $40,000 awards for exploits targeting the Oracle Autonomous AI Database, OpenAI Codex, Nvidia's Dynamo framework, the LiteLLM gateway and the Hue Bridge Pro.
Collisions: When a New Bug Is Already Known
Not every entry paid the full prize. Pwn2Own scores some as collisions, meaning part of the chain used a flaw the vendor or organizers already knew about.
Tech Analysis: Collisions explain the Pixel 10 gap: $300,000 for an all-new chain, versus $150,000 and $112,500 for chains including a known flaw. The same pattern appeared on the Galaxy S26 from day one, where several winning chains included bugs Samsung already had in hand.
What Happens to the Flaws Now
None of these were attacks on the public. Pwn2Own runs under controlled conditions, and contestants must compromise fully patched targets and demonstrate arbitrary code execution to score.
Afterwards, vendors receive the full details of every exploit shown against their products. Under ZDI's process, they have 90 days to release updates before findings are publicly disclosed — why no technical details or CVE numbers from Cork are public yet.
Two high-value targets went untested. According to SecurityWeek, no one targeted the iPhone 17 or WhatsApp, despite $300,000 top prizes for both.
What This Means for Device Owners
Practical Takeaway: There is nothing for owners to do today beyond installing security updates promptly when they arrive. The flaws found in Cork are now with the vendors, and fixes will arrive as ordinary software updates.
The results are also a reality check: a fully patched phone, speaker or printer can still contain unknown weaknesses. That is why this contest exists — to find them in a lab before anyone else does.
Bottom Line
Pwn2Own Ireland 2026 closed with more than $1.2 million paid and dozens of proven flaws now in vendors' hands. What to watch next is the patch cycle: the 90-day clock is running, and upcoming phone, printer and smart-home updates will show how quickly each company responds.
FAQ
Was my phone hacked at Pwn2Own?
No. Researchers compromised test devices in a controlled contest, not phones belonging to the public.
Why did the Pixel 10 earn more than the Galaxy S26?
Ikotas Labs earned the complete $300,000 for an all-new remote chain. Other phone entries were discounted when their chains included already-known flaws.
What is a collision at Pwn2Own?
Part of the exploit chain used a vulnerability already known to the vendor or organizers. The attack still scores, but the payout is reduced.
When will the flaws be fixed?
Vendors have 90 days under ZDI's process to release updates before findings are publicly disclosed. Install those updates as they appear.
Why did nobody attack the iPhone 17 or WhatsApp?
Reporting from the event gives no reason. Both were available targets, but no contestant registered an attempt against either.
Sources
- SecurityWeek — finale report, total payouts and Pixel 10 awards: https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/
- Zero Day Initiative — official day-three results and Master of Pwn: https://www.thezdi.com/blog/2026/10/8/pwn2own-ireland-2026-day-three-results-amp-master-of-pwn
- BleepingComputer — day one, 32 zero-days and $388,500: https://www.bleepingcomputer.com/news/security/hackers-exploit-32-zero-days-on-first-day-of-pwn2own-ireland/
- BleepingComputer — day two, 45 zero-days and Galaxy S26 results: https://www.bleepingcomputer.com/news/security/samsung-galaxy-s26-hacked-three-more-times-at-pwn2own-ireland/
- Infosecurity Magazine — day-one coverage and disclosure background: https://www.infosecurity-magazine.com/news/pwn2own-hackers-32-zeroday/
- Hero image — original AI-generated illustration created for Red Eye Eagle News.
Join the conversation
Comments
Post a Comment