Pwn2Own is a long-running competitive hacking contest where researchers demonstrate zero-day exploits against popular software and devices for cash prizes.
Three research teams broke into a fully patched Google Pixel 10 remotely at Pwn2Own Ireland on October 8, collecting $562,500 between them. Google has 90 days to ship fixes before the technical details go public, and Pixel owners have no patch or workaround to apply until then.
Reality
Researchers at Pwn2Own Ireland 2026 collected $1,262,000 for exploiting 98 zero-day flaws across seven product categories in three days. Every exploit had to work on current firmware, so owners of those products have to wait for vendor fixes.
Reality
Researchers exploited 45 unique zero-days on day two of Pwn2Own Ireland 2026 for $232,500, hacking Samsung's Galaxy S26 three times. Every target ran its latest firmware, so each win is a working code-execution bug in the build owners run today.
Reality
Pwn2Own Ireland teams logged 32 zero-days and over $368,000 in prizes on October 6, breaking LiteLLM, OpenAI Codex and Oracle's AI database. Vendors now have 90 days to ship fixes before the Zero Day Initiative publishes the details.
Reality
Pwn2Own Ireland 2026 researchers exploited 32 zero-days on day one for $388,500, including LiteLLM flaws and an OpenAI Codex argument injection. Vendors now have 90 days to ship fixes before ZDI publishes details, and the report describes contest exploits only.
Reality
ZDI's Pwn2Own Ireland 2026 schedule sets 21 exploit attempts in Cork on October 6, the largest a $300,000 remote Pixel 10 entry. The schedule names exact models and time slots, so operators of the targeted products know which results to look for on ZDI's live leaderboard.
Reality
An operator found a hidden dropper reinstalling itself every 20 minutes on his Synology NAS only because he asked why an unexplained scheduled task existed. The vendor scan reported nothing.
Reality
NIST stopped enriching every CVE, HackerOne paused the Internet Bug Bounty, Pwn2Own turned entrants away, and Cisco began bundling flaws under one ID. Attackers barely changed method.
Reality