Image: static1.squarespace.com · rights & removal

Pwn2Own Ireland 2026

Reporting by Zero Day InitiativeRead the original at thezdi.com

Executive Summary

Day One of Pwn2Own Ireland 2026 involved 21 entries targeting various categories, including multiple Samsung devices and the first Pixel entry. Several participants achieved success, earning significant prizes and Master of Pwn points, through exploiting vulnerabilities in various systems like the Sonos Era 300, Samsung Galaxy S26, and Lexmark CX532adwe. Certain results involved collisions, where multiple participants exploited the same targets, resulting in shared points and monetary awards for specific exploits. Failures occurred for several attempts, including efforts against the Brother MFC-L8970CDW and the Garmin Index BPM within the time limits. Successful exploits varied in methodology, ranging from single bug usage to combining multiple vulnerabilities like Out-of-Bounds (OOB) Write and format string bugs.

Facts Only

* Ikotas Labs, Inc. failed to exploit the Brother MFC-L8970CDW within the time limit.
* @McCaulay successfully exploited the #Sonos Era 300 using an OOB Write and a format string bug, earning $50,000 and 5 Master of Pwn points.
* @taisic successfully used an Improper Input Validation bug and code injection to gain a reverse shell on LiteLLM, earning $40,000 and 4 Master of Pwn points.
* Exploit attempts against the Lexmark CX532adwe by multiple team members failed due to time limits.
* @rewhiles successfully exploited the Samsung Galaxy S26 using four bugs, three of which were known by the vendor, earning $31,250 and 3.25 Master of Pwn points.
* @linhlhq and @sondt exploited the #Sonos Era 300 with two bugs, one of which was publicly known, earning $17,500 and 3.5 Master of Pwn points.
* Interrupt Labs (@InterruptLabs) won $20,000 and 2 Master of Pwn points by exploiting the Garmin Index BPM using an OOB Read and OOB Write.
* @nyanctl successfully exploited the #Oracle Autonomous AI Database by combining five bugs, winning $40,000 and 4 Master of Pwn points.
* Ikotas Labs, Inc. exploited OpenAI Codex using a single argument injection bug, earning $40,000 and 4 Master of Pwn points.
* @oobsio and @haehaeYang and @yibarrack used four bugs to exploit LiteLLM in the #AIInfrastructure category, resulting in a collision, earning $15k and 3 Master of Pwn points.
* @cdor1 exploited the Philips Hue Bridge Pro using five different bugs, with four being previously known, earning $6,000 and 2.5 Master of Pwn points.

Full Take

The results illustrate a tension between novel discovery and established knowledge, heavily emphasizing collision as a primary outcome rather than isolated breakthrough. The high value attached to successful exploits demonstrates that vulnerability exploitation is not just about finding the flaw, but navigating the landscape of known versus unknown vulnerabilities—the "known" vs. "zero-day" dynamic clearly dictates rewards and points. The prevalence of collisions signals that the attack surface being tested is highly interconnected; exploit chains are often discovered in relation to existing vendor knowledge, suggesting a systemic constraint on pure, unconstrained novelty. Furthermore, the success stories, particularly those involving multi-bug combinations for high-value targets like the Samsung Galaxy S26 or Oracle AI Database, suggest that leveraging context—using multiple, overlapping flaws—is more impactful than singular novel bugs in this competitive environment. This raises questions about the nature of true innovation versus sophisticated aggregation of information; what is the cost to the integrity of the discovery when successful outcomes hinge on exploiting known vendor status? What does a system that rewards collisions imply about the distribution and management of security knowledge across the ecosystem?

From the original · Zero Day Initiative

Blog Pwn2Own Ireland 2026 - Day One Results Welcome to Day One of Pwn2Own Ireland 2026! Today, 21 entries took the Pwn2Own stage to target multiple categories - including multiple Samsung attempts and our first Pixel entry.

Read the full story at thezdi.com

Sentinel — Human

Confidence

The text reads like a direct summary report from a technical competition, displaying high specificity and internal structural coherence typical of specialized reporting, rather than general-purpose AI generation.

Signals Detected

Varied sentence structure and highly specific technical result reporting; exhibits natural variation rather than mechanical rhythm.

Direct, dense presentation of raw competition results lacking typical journalistic hedging or extraneous filler.

The structure is a direct report of segmented data (Success/Failure) rather than synthesized narrative flow.

Specific technical details, usernames, and monetary awards appear precise, consistent with reporting from a known event format.

Human Indicators

The use of specific handles (@username) and direct, unmediated presentation of highly granular competition results strongly suggests an insider or specialized reporter rather than generalized LLM output.

The structure mimics typical event results reporting where explicit success/failure outcomes are listed sequentially.