Pwn2Own Ireland 2026 day one: 32 zero-days and US$388,500 awarded, with exploits against the Samsung Galaxy S26, Oracle Autonomous AI Database, OpenAI Codex, LiteLLM, Philips Hue Bridge Pro, Sonos Era 300, Lexmark printers and a Garmin blood pressure monitor
Trend Micro's Zero Day Initiative (ZDI) posted day-one results for Pwn2Own Ireland 2026 on 6 October; BleepingComputer counts 32 zero-days and US$388,500 awarded on the day. Successful entries included: VinSOC chaining five bugs against the Oracle Autonomous AI Database (US$40,000) and seven zero-days against the Philips Hue Bridge Pro smart-home hub (US$40,000); Ikotas Labs exploiting the OpenAI Codex cloud coding agent with a single argument-injection bug (US$40,000) and, with collisions on known bugs, the Samsung Galaxy S26; Xint's Taisic Yun getting a reverse shell on the LiteLLM AI gateway with an improper input validation bug plus code injection (US$40,000), with a second LiteLLM win by Out of Bounds; McCaulay Hudson combining an out-of-bounds write and a format string bug on the Sonos Era 300 (US$50,000); Lexmark CX532adwe printer wins for Team Confused (one use-after-free) and Summoning Team; and Interrupt Labs taking the first wellness-category win against the Garmin Index BPM blood pressure monitor with an out-of-bounds read and write. Viettel Cyber Security and Interrupt Labs also compromised the Galaxy S26, but most of their bugs were already known to Samsung. Attempts against the Google Pixel 10, a Brother printer and Chroma ran out of time. Vendors have 90 days to ship fixes before ZDI publishes details; no CVEs have been assigned yet. Primary: ZDI; wire: BleepingComputer.
- Product
- Samsung Galaxy S26; Oracle Autonomous AI Database; OpenAI Codex; LiteLLM; Philips Hue Bridge Pro; Sonos Era 300; Lexmark CX532adwe; Garmin Index BPM
- Versions
- n/a — contest disclosures; fixes and CVEs pending from vendors (90-day window)
- Exploited in Australia?
- unknown
- Patch to
- Nothing to install yet. Watch the Samsung, Oracle, LiteLLM, Philips Hue, Sonos, Lexmark and Garmin security bulletins over the next 90 days and patch when fixes land. Meanwhile keep LiteLLM proxies and printer admin interfaces off the internet, keep smart-home hubs and speakers on a separate network segment, and keep phones on the latest monthly security update.
Primary: Zero Day Initiative — Pwn2Own Ireland 2026: Day One Results (6 Oct 2026) · Vendor: Zero Day Initiative — Pwn2Own Ireland 2026: the full schedule · BleepingComputer — Hackers exploit 32 zero-days on first day of Pwn2Own Ireland (6 Oct 2026)