Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › cybersecurity

Pwn2Own Ireland 2026 Day One: 32 Zero-Days Reported, $388,500 Awarded

By Freedom251 Team · · 2 min read

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Contest researchers demonstrated attacks against targets including the Samsung Galaxy S26, Philips Hue Bridge Pro, Oracle Autonomous AI Database, LiteLLM, Lexmark and Canon printers, OpenAI Codex, and Sonos Era 300 on the first day of Pwn2Own Ireland 2026. BleepingComputer reported 32 exploited zero-days and $388,500 in awards; those totals describe contest results, not evidence that the flaws are being exploited in the wild.

What happened on Day One?

Pwn2Own Ireland 2026 opened in Cork on October 6, with the event scheduled to run through October 9. The Zero Day Initiative (ZDI) listed 21 entries for Day One across Mobile Phones, Smart Home Devices, Wellness, Printers, Messaging, AI Infrastructure, and AI Coding Agents. Wellness and AI Coding Agents were new categories for this event. ZDI’s results page documents the individual entries and outcomes; BleepingComputer reported the event-wide Day One totals of 32 exploited zero-days and $388,500 in awards.

As an Amazon Associate I earn from qualifying purchases.

The figures have different sources: 21 is ZDI’s published entry count, while the 32-zero-day and award totals are BleepingComputer’s aggregate report, not totals stated on ZDI’s entry-by-entry page. ZDI author Dustin Childs said, “Today, 21 entries took the Pwn2Own stage to target multiple categories – including multiple Samsung attempts and our first Pixel entry.”

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Which targets were successfully compromised?

BleepingComputer reported successful demonstrations involving the Samsung Galaxy S26, Philips Hue Bridge Pro, Oracle Autonomous AI Database, LiteLLM, Lexmark CX532adwe, Canon imageFORCE 1643F, OpenAI Codex, and Sonos Era 300. The results span phones, smart-home equipment, AI infrastructure and coding software, printers, and a speaker.

ZDI’s entry records describe several example techniques: a seven-zero-day exploit against the Hue Bridge Pro; improper input validation combined with code injection against LiteLLM; a use-after-free against the Lexmark CX532adwe; and argument injection against OpenAI Codex. These are descriptions of contest demonstrations, not complete advisories or a full account of every exploit.

Why “32 zero-days” does not mean 32 entirely new flaws

A zero-day tally can include vulnerabilities that are not newly unknown to the vendor. ZDI marked successful entries involving the Galaxy S26, Sonos, LiteLLM, and Hue Bridge Pro as collisions or as involving bugs already known to a vendor or previously known. A collision means a contestant’s finding overlapped with a vulnerability that was already known, rather than representing a wholly novel discovery. The headline total should therefore not be read as 32 distinct, newly uncovered flaws.

Which attempts failed?

Not every entry resulted in a successful demonstration. White Noise Club’s Google Pixel 10 attempt failed within the allotted time. ZDI also recorded unsuccessful attempts against a Brother printer, a Lexmark entry, and a Garmin Index BPM.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Results should be read at the attempt level: a separate Garmin Index BPM entry succeeded. The record therefore supports neither a blanket claim that the model was compromised in every attempt nor a claim that it was safe.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What the results do—and do not—show

Pwn2Own results document controlled demonstrations by contest researchers. The cited Day One reports do not establish that these vulnerabilities are being exploited in real-world attacks, and they do not provide a reason by themselves to buy or replace any named product.

The reports also do not provide complete affected software or firmware versions, CVE identifiers, CVSS scores, or full exploit details for every entry. Because the event was scheduled to continue through October 9, the Day One figures should not be treated as final totals for the full competition.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

cybersecuritydevice securityPwn2Own IrelandZero Day Initiativezero-day vulnerabilities

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.