Vulnerabilities

Pwn2Own Ireland 2026 closed in Cork on October 8 after three days. The Zero Day Initiative (ZDI), the Trend Micro bug bounty program that runs the contest, paid $1,262,000 for 98 unique zero-days from 29 teams and 61 completed attempts. That is up from $1,024,750 for 73 zero-days at the same contest in 2025. Ikotas Labs won Master of Pwn, the overall title, with 42.5 points and $361,000.

The exploits now sit with the vendors, who have about 90 days to ship fixes before ZDI publishes the details. If your staff carry a Google Pixel 10 or Samsung Galaxy S26, your developers use OpenAI Codex, you run Oracle Autonomous AI Database, or your offices have smart home hubs and multifunction printers, there is a working exploit for something you own and no public patch yet. The first two days are in our earlier write-up.

How the final day changed the picture

Day three was about the Google Pixel 10, which had held through the first two days. Three teams compromised it on October 8. Ikotas Labs chained multiple bugs for $300,000, the largest single award of the contest. Tim Becker and Yves Bieri of Xint used a single bug for $150,000, and Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara earned $112,500 with a two-bug chain. ZDI marked all three entries as collisions, which means at least one bug in each was already known to ZDI or Google.

The Galaxy S26 was compromised seven times across the three days, by three teams each on days one and two and by BunkyoWesterns on day three. Many of those chains reused known bugs: on day two, PetoWorks used three collisions and Kyeongmin Kim of KAIST Hacking Lab used two collisions plus one new bug. Apple's iPhone 17 carried a $300,000 top award for a remote hack, but no team registered to attempt it.

Ikotas Labs also took OpenAI Codex on day one with a single argument injection bug. Argument injection means text the attacker controls, such as a file or branch name in a repository, ends up as an option on a command the agent runs. Under the contest rules the agent is opened inside an untrusted repository, so a developer cloning the wrong project is the realistic scenario. Ikotas Labs added a seven-bug chain against Oracle Autonomous AI Database on day two, and OtterSec and Platform Security compromised the same database again on day three, mostly with collisions.

Outside phones and AI, the Brother MFC-L8970CDW printer fell on day three to a single FuzzingLabs zero-day worth $20,000, after holding on the first two days. The Canon imageFORCE 1643F was compromised twice and the Lexmark CX532adwe again. The Philips Hue Bridge Pro fell four times and Home Assistant Green was hit twice more. The new wellness category had one reported attempt on the last day, against the Garmin Index BPM blood pressure monitor, which ran out of time.

Xint finished second with $240,000 and 27.5 points, and Team ZyGoat third with $125,000 and the same 27.5 points. Day one paid $388,500 for 32 zero-days, a figure ZDI and BleepingComputer agree on. For days two and three, ZDI posted no daily total and sources give different splits, so we use only the contest totals.

What the 90-day window means

ZDI buys each winning exploit and reports it privately to the vendor. BleepingComputer and Privacy Guides both describe a 90-day window before ZDI publishes details. ZDI's own disclosure policy gives 120 days as its standard deadline, so the public sources do not agree on the exact clock. Counted from the contest days, 90 days ends between January 4 and January 6, 2027, and 120 days in early February. If a vendor misses the deadline, the policy says ZDI publishes a limited advisory with mitigations.

The record from earlier contests shows what the end of the window looks like. An earlier Pwn2Own bug in Codex, CVE-2026-19591 (CVSS 7.8), was reported to OpenAI on June 2, 2026 and published as ZDI-26-649 on September 10, 100 days later, after OpenAI had shipped an update. The advisory title starts with "(Pwn2Own)", which is the easiest way to spot these on ZDI's published list.

Collisions can shorten the wait. A collided bug was reported to the vendor before the contest, so a fix may already be in testing, and Samsung or Google can ship it in a monthly security update before any contest advisory appears. A bug that two teams found on their own is also one that someone outside the contest could find. For the Galaxy S26 and Pixel 10 in particular, install each monthly update as soon as it lands rather than waiting for a ZDI advisory to say it matters.

What to do during the window

No exploitation outside the contest has been reported, and the technical details are private, so there are no indicators of compromise to hunt for. The work is shrinking exposure until the fixes arrive.

1. List what you own. Match the affected models against your asset inventory: Pixel 10 and Galaxy S26 handsets, Codex installs (CLI and IDE extensions), Oracle Autonomous AI Database instances, Philips Hue Bridge Pro and Home Assistant Green hubs, and Brother MFC-L8970CDW, Canon imageFORCE 1643F and Lexmark CX532adwe printers. Give each one an owner.
2. Make phone updates land fast. In Microsoft Intune, the Android Enterprise compliance policy has a "Minimum security patch level" setting under Device properties; devices below it become noncompliant, and Conditional Access can then block them from email and files. Raise the value each month once the new Samsung and Pixel updates are out. Other MDM tools have an equivalent rule.
3. Restrict coding agents. For repositories you did not write, OpenAI's documentation recommends a read-only sandbox (sandbox_mode = "read-only" in config.toml) with approval_policy = "on-request"; the older untrusted approval value is retired and should be removed from configs. Leave network access at its default of off, and do not set approval_policy = "never" on developer machines. Keep production credentials and long-lived tokens out of the environment the agent runs in, and update the CLI and IDE extension whenever a release ships.
4. Keep Oracle Autonomous AI Database off the internet. Oracle patches the managed service itself, so your lever is network access: use a private endpoint or an access control list limited to your application subnets.
5. Segment IoT and printers. Put smart home hubs on their own VLAN with no route to corporate subnets and automatic updates on. Restrict printer web management to admin workstations, leave users only the print ports they need (TCP 9100 and IPP on TCP 631), and turn on automatic firmware updates where the model supports it.
6. Watch the advisories. Check ZDI's upcoming advisories page weekly for the vendors above; each entry shows the vendor, CVSS score and report date, and moves to the published list with a CVE once a fix is out.

The wider lesson

Phones have a working update pipeline: a monthly bulletin, an MDM rule, a compliance gate. Printers, smart home hubs and coding agents often have none, and this year they were compromised again and again. A dated list of exploited models is a good prompt to give those devices the same treatment: an owner, an update setting and a network boundary.

Our attack surface management work keeps that inventory current, and AI-native systems covers how coding agents and AI databases are deployed and locked down. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: ZDI Pwn2Own Ireland 2026 day three results and Master of Pwn, ZDI day two results, ZDI day one results, ZDI disclosure policy, ZDI-26-649 advisory, ZDI Pwn2Own Ireland 2025 day three and Master of Pwn, BleepingComputer, final results, BleepingComputer, Galaxy S26 day two, CyberInsider, Privacy Guides, Microsoft Learn, Android Enterprise compliance settings, OpenAI Codex sandbox and approvals.