Pwn2Own Ireland 2026

This week, Pwn2Own — one of the best-known hacking competitions in the world — wrapped up in Cork, Ireland. Over three days, researchers demonstrated 98 previously unknown vulnerabilities and walked away with more than $1.26 million in prizes.

Every single target was running the latest updates. The Samsung Galaxy S26 fell seven times, the Google Pixel 10 three times, and AI tools, printers and even a digital blood pressure monitor were hit as well.

Today we’ll go through what happened in Cork and, more importantly, what it means for you if you’re responsible for a corporate network, employees’ mobile phones or AI tools.

Hi, my name is Patrik Žák, and welcome to Security Sunday.

The competition is run by the Zero Day Initiative, ZDI for short, which is part of Trend Micro. The idea is simple: find zero-day vulnerabilities before attackers do, and hand them over to the vendors.

The rules are strict. The target must be running the latest firmware and software version, and the researcher has to demonstrate code execution. Each attempt has a time limit and the order is drawn at random. Only the first person to compromise a given target gets the full prize. Anyone who succeeds after that earns points towards the overall ranking, known as Master of Pwn.

Vendors then have 90 days to ship a fix, and only after that does ZDI publish the technical details.

Test your company before the hackers do — with red teaming, penetration testing or phishing simulations. Get in touch at patrik@sysnetshield.com.

This year, ZDI also tightened registration. Only researchers who had already earned at least $15,000 in ZDI bounties could compete, plus a maximum of ten newcomers. So the people who met in Cork really were the top of the field.

Day one saw 32 zero-days and almost $389,000 paid out. Day two brought 45 zero-days for $233,000, and day three only 21 zero-days — but for $641,000, because that’s when the Pixel phones came up.

29 teams competed across seven categories: phones, AI infrastructure, AI coding agents, messaging, smart home, printers and — new this year — wellness devices.

The winner was Ikotas Labs with 42.5 points and $361,000, with Xint in second place and Team ZyGoat in third.

For comparison: last year’s event here produced 73 zero-days for roughly a million dollars. At Pwn2Own Berlin in May, which focused mainly on enterprise software, there were 47.

A higher number on its own doesn’t mean the products have got worse, though. The number of teams and their skill level keep rising, and as AI tools become part of vulnerability research, the number of findings will keep growing.

Let’s take a look at some of the categories and what was found.

Phones

In the phone category, the Samsung Galaxy S26 fell a total of seven times. One detail caught my attention: all three attacks on day one included bugs Samsung already knew about. So the phone had every update installed, and it still contained bugs the vendor was aware of.

The Google Pixel 10 held out for the first two days, but on day three it fell three times. Ikotas Labs received $300,000 for a chain of several bugs — the highest single prize of the whole competition — and that secured their overall win.

And the iPhone? There was a $300,000 prize on offer for a remote attack, but nobody registered.

AI tools

The second big group of targets was AI tools.

The OpenAI Codex agent fell to a single argument injection bug. AI infrastructure was also hit repeatedly. On the LiteLLM proxy, the Xint team got a reverse shell. NVIDIA Dynamo and the Chroma vector database fell as well.

This isn’t a one-off. Back in May in Berlin, LiteLLM and Cursor fell, and there was a successful attack on Claude Code too. AI tools have become a regular target, and I expect to see more of them at future events.

Smart home, printers and wellness

In the smart home category, the Philips Hue Bridge Pro fell to a chain of seven zero-days from team VinSOC. The Sonos Era 300 speaker and Home Assistant Green didn’t escape either.

Printers traditionally produce the fun moments. Interrupt Labs got Doom running on the display of a Lexmark printer. It looks like a joke, but what it really means is full control over a device that sits on the same corporate network as the rest of the office. On a Canon printer, hard-coded credentials and command injection were exploited.

In the new wellness category, the Garmin Index BPM blood pressure monitor fell.

What this means for you

The Galaxy S26 case shows the gap between the moment a vendor knows about a bug and the moment the fix actually lands on the device.

Vendors now have 90 days to ship fixes. In my experience, though, the riskiest period often comes after the patch is released. Attackers compare the patched and unpatched versions — so-called patch diffing — and build an exploit from the difference. Anyone who then doesn’t update their printers or smart hubs is an easy target.

So these 98 bugs are now heading to the vendors instead of ending up in attackers’ arsenals. Paradoxically, products that show up at these competitions are in a better position than those nobody tests publicly.

OK, so we know about the vulnerabilities. The question is: what do we do about it?

I’d start with an inventory of AI tools — which ones you have, who manages them and whether they’re reachable from the internet.

For AI coding agents, set clear rules: no working with untrusted repositories outside a sandbox, tokens with the least privilege possible, and review of the commands the agent runs.

Printers, smart hubs and meeting room equipment belong in a separate network segment, ideally without internet access. And their firmware belongs in the same patch management process as Windows.

For mobile phones, enforce an up-to-date security patch level through MDM.

And if you want to know where your network really stands, get a penetration test that also covers printers, IoT and AI infrastructure. Get in touch — we’ll be happy to test your infrastructure before an attacker does.

Summary

So let’s sum it up. 98 zero-days and $1.26 million in three days, all on fully patched devices. Galaxy S26 seven times, Pixel 10 three times, plus repeated hits on AI tools, printers and wellness devices.

Updates are the bare minimum. Whether an attacker succeeds, though, mostly comes down to whether you know what’s running on your network, whether it’s segmented, and whether you’ll notice when something is going on.

FBI arrests another ShinyHunters suspect

FBI Director Kash Patel announced on Friday, October 9, that agents had arrested another suspected co-conspirator from the ShinyHunters group, which the FBI blames for the September breach of its FBIjobs.gov recruitment portal. Patel did not name the suspect or say where the arrest took place. The New York Times and CBS News, citing unnamed sources, reported that the suspect is a Canadian citizen arrested this week in Pennsylvania who is believed to have been directly involved in the breach.

The Pennsylvania arrest is the third publicly known action in the case in less than four weeks. On September 15, Dutch police arrested a 24-year-old man from Amsterdam whom media identified as Pepijn van der Stap. The FBI described him as one of the group’s alleged leaders, but the group denied any connection to him. He was also detained before ShinyHunters had even announced the FBI breach. Reuters later reported that Jordanian authorities had detained a man named Saif al-Din Khader, known online as “Rey”, on September 29, and that he is now cooperating with the FBI. Shortly afterwards, the site where the group published stolen data went offline and its main spokesperson went silent. A new leak site later appeared, however, suggesting that at least some members are still active.

AT&T to pay $177 million over two data breaches

On October 2, 2026, a federal judge in the U.S. District Court for the Northern District of Texas granted final approval to a $177 million class action settlement. The settlement covers two security incidents AT&T disclosed in 2024. The first incident has a $149 million fund and the second a $28 million fund. Attorneys’ fees and settlement administration costs are also paid out of these funds. AT&T settled without admitting liability or wrongdoing, and the court overruled objections that the amount was insufficient.

The company disclosed the first incident (“AT&T 1”) on March 30, 2024, after a dataset containing customer information appeared on the dark web. It affected approximately 7.6 million current and 65.4 million former account holders.

The second incident (“AT&T 2”), disclosed on July 12, 2024, was part of a wider campaign targeting customer accounts on the Snowflake cloud platform. Attackers downloaded call and text message metadata for nearly all of AT&T’s mobile customers from AT&T’s Snowflake workspace.

Critical Citrix NetScaler vulnerabilities: CVE-2026–88771 and CVE-2026–88772

Attackers are actively exploiting CVE-2026–88771, a critical vulnerability (CVSS v4.0: 9.5) in Citrix NetScaler ADC and NetScaler Gateway that allows unauthenticated attackers to inject and execute arbitrary commands (command injection). Citrix disclosed it on September 27, 2026, in bulletin CTX697096 together with seven other flaws, including a second actively exploited vulnerability, CVE-2026–88772 (also CVSS v4.0: 9.5).

According to the vendor, all deployments are vulnerable to CVE-2026–88771, including those in the default configuration. The U.S. agency CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog the same day. According to eSentire, attackers had been exploiting the flaw as a zero-day since early September, and Palo Alto Networks’ Unit 42 counted more than 50,000 publicly exposed instances that may be vulnerable as of September 27.