98 zero-days demonstrated at Pwn2Own Ireland 2026
98 zero-days demonstrated at Pwn2Own Ireland 2026
Pwn2Own Ireland 2026 concluded on October 9, 2026 with 98 zero-day vulnerabilities demonstrated across mobile phones, AI infrastructure, printers, smart home devices, and healthcare devices. Security and endpoint teams should check current detection coverage against the targeted platforms and categories before vendor patches arrive.
Over three days, 29 research teams exploited 98 zero-day vulnerabilities across seven product categories:
- Mobile phones: Samsung Galaxy S26 and Google Pixel 10 (multiple successful compromises each day, including a $300,000 chain exploit against the Pixel 10)
- AI infrastructure: Oracle Autonomous AI Database
- AI coding apps: OpenAI Codex
- Messaging apps: (targeted; specific products not named in the source)
- Smart home devices: (targeted; specific products not named in the source)
- Printers: (targeted; specific products not named in the source)
- Wellness/healthcare devices: (new category this year; specific products not named in the source)
All targets were required to run the latest firmware or software versions. Contestants were required to demonstrate arbitrary code execution. Total prizes paid: $1,262,000. Apple's iPhone 17 was listed as a target at up to $300,000 for a remote exploit, but no contestant registered an attempt.
Under Pwn2Own rules, ZDI notifies vendors of all disclosed zero-days. Vendors have 90 days to patch before ZDI publishes details publicly.
The source does not identify which specific organizations or user populations are affected. The vulnerabilities were demonstrated on Samsung Galaxy S26, Google Pixel 10, OpenAI Codex, and Oracle Autonomous AI Database, among others. All exploited devices were running current firmware. No patches have been released yet; the 90-day vendor disclosure window begins from the competition date.
Competition concluded October 9, 2026. Vendors have 90 days from disclosure to release patches before ZDI publishes vulnerability details publicly. The source does not give individual patch release dates for any vendor.
- Identify whether Samsung Galaxy S26 or Google Pixel 10 devices are enrolled in your mobile device management environment and note that patches are not yet available
- Identify whether OpenAI Codex or Oracle Autonomous AI Database are in use in your environment
- Review mobile threat defense and EDR coverage for the targeted device categories (mobile phones, AI coding tools, smart home, printers, healthcare devices)
- Track ZDI advisories and vendor security bulletins for the affected products over the next 90 days
- When patches are released, prioritize them for managed devices in the affected categories
- Check whether your detection and response runbooks cover arbitrary code execution scenarios on mobile endpoints
My read is that the breadth of categories this year, particularly AI infrastructure and AI coding apps alongside mobile, signals that researchers are actively probing the expanded surface area organizations are adopting. The 90-day vendor patch window means specific technical details will not be public yet, but the categories alone are enough to inform a coverage gap review now.
I would use the category list, not the payout numbers, as the planning input. Map each targeted category against your current asset inventory and detection stack. The source does not provide exploit technical details, so specific mitigation steps are not yet possible. Prioritize patch deployment as vendors release fixes, and watch ZDI's advisories as the 90-day window closes.
The source is a BleepingComputer news report dated October 9, 2026, covering competition results and prize totals; it does not include vulnerability technical details, CVE identifiers, affected software versions, or vendor patch timelines.