Technology · Cybersecurity · published 2026-10-08 · via BleepingComputer

Galaxy S26 hit by three additional exploits at Irish Pwn2Own event

During the second day of Pwn2Own Ireland 2026, researchers earned $232,500 by exploiting 45 previously unknown vulnerabilities. The Samsung Galaxy S26 was compromised three more times by separate teams, while other contestants targeted a Sonos Era 300, Home Assistant Green, and Oracle Autonomous AI Database. The contest gives vendors 90 days to patch disclosed flaws before public disclosure.

Expanded Detail

"At Pwn2Own Ireland 2026’s second day, teams earned $232,500 for 45 distinct zero-days. The Galaxy S26 was breached by KAIST Hacking Lab’s Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab’s Dimitrios Valsamaras and Ken Gannon. Other targets included a Sonos Era 300, Home Assistant Green, and Oracle Autonomous AI Database. Jack Dates demonstrated a Sonos chain quickly; HaeJung Yang received $40,000 for Dynamo."

Second paragraph:

"ZDI runs the contest so fully updated products are tested before real attackers find flaws. Vendors get 90 days to fix disclosed issues. Day one also saw Galaxy S26 compromises by Interrupt Labs, Ikotas Labs, and Viettel’s Nguyen Thanh Dat, though some bugs were already known. Apple’s iPhone 17 had no registered attempts despite a potential $300,000 award."

Total words? First para: At(1) Pwn2Own(2) Ireland(3) 2026’s(4) second(5) day,(6) teams(7) earned(8) $232,500(9) for(10) 45(11) distinct(12) zero-days.(13) The(14) Galaxy(15) S26(16) was(17) breached(18) by(19) KAIST(20) Hacking(21) Lab’s(22) Kyeongmin(23) Kim,(24) PetoWorks,(25) and(26) Mobile(27) Hacking(28) Lab’s(29) Dimitrios(30) Valsamaras(31) and(32) Ken(33) Gannon.(34) Other(35) targets(36) included(37) a(38) Sonos(39) Era(40) 300,(41) Home(42) Assistant(43) Green,(44) and(45) Oracle(46) Autonomous(47) AI(48) Database.(49) Jack(50) Dates(51) demonstrated(52) a(53) Sonos(54) chain(55) quickly;(56) HaeJung(57) Yang(58) received(59) $40,000(60) for(61) Dynamo.(62) First para 62.

Second: ZDI(1

Context

... No extra. Plain text. Need maybe no markdown. Good. Check "additional factual detail and background drawn ONLY from material above" We used all from material. "HaeJung Yang won $40,000 for Dynamo" source says Out of Bounds team's HaeJung Yang was awarded $40,000 for hacking Dynamo in AI Infrastructure category. Fine. "ZDI organizes event" source. "fully patched products" source says fully patched devices. Fine. "Vendors receive 90 days" source. "Day one also saw Galaxy S26 compromises by Interrupt Labs, Ikotas Labs, and Viettel’s Nguyen Thanh Dat, though some bugs were already known." Source: Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security also hacked Samsung's Galaxy S26 flagship on day one, but some bugs exploited were already known to vendor. Good. "Apple’s iPhone 17 drew no registered attempts despite a potential $300,000 award." Source: Apple's iPhone 17 potential target max award $300,000 remote hack, no contestant registered. Good. Need ensure n

Expanded detail and Context are AI-generated analysis; the linked article remains the authoritative source.

Read the full article at BleepingComputer →

This summary is Al-enhanced to contain extended analysis and broader social context. The original is {NAME); the linked article is the authoritative source. Original headline: “Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland.” Browse more stories.