Galaxy S26, Sonos and smart home hubs hacked as Pwn2Own Ireland 2026 tops 77 zero days

Security researchers have spent this week breaking into phones, smart home hubs, printers and AI software in front of judges, and the results are a useful reminder that no device is finished when it ships. At Pwn2Own Ireland 2026, the hacking contest run by Trend Micro's Zero Day Initiative (ZDI), researchers exploited 32 zero days on the first day and 45 more on the second, according to BleepingComputer. Samsung's Galaxy S26 was among the most popular targets.

Here is what was hacked, why these contests matter to ordinary owners, and what you should actually do about it.

What happened at Pwn2Own Ireland 2026

Pwn2Own is a competition where security researchers try to break into fully patched, current products. If an attack works within the time limit, the team wins cash and the bug details go privately to the vendor. A zero day is a flaw the maker did not know about, so there was no fix for it at the moment it was used.

The 2026 edition started on October 6. On day one, researchers earned $388,500 for 32 zero days, BleepingComputer reported. Day two added $232,500 for 45 unique zero days. Taken together, that is 77 zero days and $621,000 in awards across the first two days, before the final day's attempts were counted.

For context, the 2025 Ireland contest produced 73 zero days and $1,024,750 in total awards over its full run, according to BleepingComputer. This year's event passed last year's zero day count before the final day began.

The Galaxy S26 fell repeatedly

Samsung's newest flagship was hacked on both days. On day one, Interrupt Labs, Ikotas Labs and Nguyen Thanh Dat of Viettel Cyber Security were named among those who targeted it, though BleepingComputer noted that some of the bugs used were already known to Samsung.

On day two, three more teams compromised the Galaxy S26: Kyeongmin Kim of KAIST Hacking Lab, PetoWorks, and Dimitrios Valsamaras with Ken Gannon of Mobile Hacking Lab. ZDI's schedule showed one more Galaxy S26 attempt planned for day three.

Google's Pixel 10 had a quieter time. A team called White Noise Club tried it on day one but did not finish within the time limit, and Kyeongmin Kim withdrew a USB based attempt before day two began. ZDI listed three more Pixel 10 attempts for the final day.

Apple's iPhone 17 drew no registrations at all, even with up to $300,000 on offer for a remote hack, according to BleepingComputer.

Smart home gear and AI tools were hit too

Phones were only part of the story. On day one, the team VinSOC topped the leaderboard by earning $40,000 for a seven zero day chain against the Philips Hue Bridge Pro and another $40,000 for a five zero day chain against Oracle's Autonomous AI Database.

Other day one results included a Sonos Era 300 speaker compromised with four vulnerabilities, Lexmark and Canon office printers, zero days in the LiteLLM AI gateway, and OpenAI's Codex coding tool taken down with a single argument injection bug.

Day two brought more smart home damage. The Home Assistant Green hub was hacked by several teams, including PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, and a Doyensec pair. Jack Dates of RET2 Systems ran an exploit chain against the Sonos Era 300 in under a minute. A researcher earned $40,000 against Dynamo, an AI infrastructure target, and Ikotas Labs broke into Oracle's AI database with a seven part zero day chain.

This year's contest covered seven categories, including phones, messaging apps, smart home devices, printers, AI infrastructure, AI coding apps, and wellness and health devices.

Why Pwn2Own Ireland 2026 matters for regular owners

It is easy to read a headline like "Galaxy S26 hacked three more times" and assume your phone is in danger today. That is not quite how this works.

Pwn2Own is a controlled setting. The bugs go straight to the vendor, and under ZDI's process, companies get 90 days to release a fix before details are made public. The whole point is to find these holes before criminals do and get them closed. In that sense, a busy contest is good news, because dozens of flaws are now headed for patches instead of sitting undiscovered.

The less comforting part is what the results say about how common serious flaws are. If skilled researchers can chain together multiple unknown bugs in a flagship phone, a popular smart speaker and a smart home hub in a single week, similar flaws almost certainly exist in other products too. Some of them may be found by people who will not report them.

The AI results deserve attention as well. AI coding assistants, model gateways and AI databases are new enough that their security is still maturing, and they often have broad access to code, data and company systems. The software industry is already wrestling with this; Google recently paused part of its open source bug bounty after a flood of AI generated reports.

Who is affected

Owners of the devices named above are the most directly affected, but only in the sense that patches are coming:

• Samsung Galaxy S26 owners should expect security fixes in upcoming monthly updates.
• Home Assistant, Philips Hue and Sonos users should watch for firmware and software updates.
• Businesses running Oracle's Autonomous AI Database, LiteLLM, Dynamo or AI coding tools should follow vendor advisories closely.
• Offices with Lexmark or Canon printers should make sure firmware updates are not being ignored, which is common with printers.

There is no sign in the reporting that any of these bugs are being exploited outside the contest.

What to do now

You do not need to panic or stop using any of these products. You do need to keep them updated, because that is how the fixes from Pwn2Own will reach you.

1. Turn on automatic updates on your phone and install monthly security patches when they arrive. If you are shopping for a new phone, how long a maker supports it with updates is worth weighing, as we explain in our smartphone buying guide.
2. Update smart home hubs and speakers. These often update quietly, but check the app for pending firmware. Our smart home starter guide covers basic setup habits.
3. Do not forget the printer. Office printers sit on the network for years and rarely get patched.
4. Lock down your accounts. Strong, unique passwords and two step verification limit the damage if any single device is compromised. Our guide to protecting your accounts in 10 minutes walks through it.
5. IT teams should track vendor advisories for the affected AI and enterprise tools, the same way they would for any actively watched product. We covered a recent example of why speed matters with the Citrix NetScaler zero days.

What to watch next

The final day's results and the Master of Pwn title, awarded to the team with the most points, will be posted by ZDI. ZDI's day three preview listed 17 attempts with roughly $1.33 million on the board, including more tries at the Pixel 10, the Galaxy S26, Philips Hue, Home Assistant and Oracle's AI database. It also said the Master of Pwn race could still be unsettled going into the final hour.

After that, watch the next 90 days. Samsung, Google, Sonos, Oracle and the other vendors will need to ship fixes before ZDI publishes details. For ongoing security coverage, visit our tech news section.

Frequently asked questions

What is Pwn2Own?

Pwn2Own is a hacking competition run by Trend Micro's Zero Day Initiative where researchers earn cash for breaking into current, fully patched products. The bugs are reported privately to the vendors.

Was my Galaxy S26 hacked?

No. The attacks happened on contest devices. The flaws were reported to Samsung, which is expected to fix them in future security updates.

How long do companies have to fix Pwn2Own bugs?

Vendors typically get 90 days to release a patch before ZDI publicly discloses the details.

Was the iPhone 17 hacked at Pwn2Own Ireland 2026?

No contestant registered to attempt a remote iPhone 17 hack, despite a prize of up to $300,000.