Samsung Galaxy S26 hacked six times across two days at Pwn2Own Ireland 2026
Samsung Galaxy S26 hacked six times across two days at Pwn2Own Ireland 2026
Security researchers demonstrated six successful zero-day exploits against a fully patched Samsung Galaxy S26 across the first two days of Pwn2Own Ireland 2026. Endpoint and security teams managing Android devices should note that these vulnerabilities remain unpatched until Samsung issues fixes, which ZDI policy gives vendors up to 90 days to deliver.
On day two of Pwn2Own Ireland 2026, three separate teams successfully exploited the Samsung Galaxy S26: KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab's Dimitrios Valsamaras and Ken Gannon. Three additional exploits against the same device were demonstrated on day one by Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security, though the source notes some day-one bugs were already known to Samsung. All devices at Pwn2Own run the latest firmware versions. Contestants must demonstrate arbitrary code execution to claim awards. Day-two competitors collected $232,500 across 45 unique zero-day vulnerabilities in total, spanning multiple device categories.
The source does not specify which Samsung Galaxy S26 attack surface (USB, network, application layer, or other) was used in each day-two exploit, nor does it describe the privilege level achieved or whether any exploit chains require user interaction. The source states that after disclosure at Pwn2Own, vendors have 90 days to patch before ZDI publicly discloses the vulnerabilities. Samsung Galaxy S26 devices remain unpatched against these specific zero-days until Samsung releases fixes. The source does not state which other Android or Samsung devices are affected.
- Pwn2Own Ireland 2026 day two: October 8, 2026.
- Day three of the contest will include additional Samsung Galaxy S26 and Google Pixel 10 attempts, per the source.
- ZDI policy: vendors have 90 days from Pwn2Own disclosure to patch before public vulnerability disclosure.
- The source does not give a date for when Samsung will release patches.
- Confirm whether Samsung Galaxy S26 devices are present in your managed fleet.
- Monitor Samsung's security bulletin channel for patches addressing vulnerabilities disclosed at Pwn2Own Ireland 2026; the 90-day ZDI disclosure window means patches may arrive any time within roughly three months of October 8, 2026.
- Review mobile threat defense (MTD) and EDR coverage for Android to understand whether current detections would surface arbitrary code execution on Galaxy S26 devices.
- Check whether your mobile device management policy enforces prompt OS and firmware update installation on Samsung devices.
- The source does not describe the specific attack vectors used in day-two exploits; I would wait for full technical disclosure before modelling precise detection rules, but I would use this event to validate that Android device compliance baselines are current.
My read is that six successful exploit demonstrations against a single flagship device across two contest days indicates a broad attack surface rather than a narrow, hard-to-reach vulnerability. The source does not describe the attack vectors in detail, so it is not possible to determine whether these require physical access, local network position, or remote reachability. The withdrawal of a USB-based Google Pixel 10 attempt by one researcher is noted in the source but no reason is given.
My recommendation is to treat the Galaxy S26 as an elevated-risk device until Samsung publishes patches and advisories that address these specific Pwn2Own findings. I would prioritise enforcing automatic security update policies on managed Android devices now, before technical details are publicly disclosed at the end of ZDI's 90-day window.
The source is a BleepingComputer news article dated October 8, 2026, covering day-two results at Pwn2Own Ireland 2026; it reports outcomes and award amounts but does not include technical vulnerability details, specific attack vectors, affected software components, or Samsung's patch timeline.