Samsung Galaxy S26 Hacked Again at Pwn2Own Ireland
The Samsung Galaxy S26 flagship faced additional compromises on the second day of the Pwn2Own Ireland 2026 competition as security researchers collected substantial cash awards.
Radwan AbdulhadiEditor and technology writer
Samsung Galaxy S26 Targeted on Day Two
On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. A major highlight of the day was the Samsung Galaxy S26 flagship getting hacked three times by Kyeongmin Kim from the KAIST Hacking Lab, PetoWorks, and Dimitrios Valsamaras and Ken Gannon from the Mobile Hacking Lab.
These additional compromises follow prior security breaches on the first day, when Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security also successfully hacked Samsung's Galaxy S26 flagship, though some of those exploited bugs were already known to the vendor.
Diverse Exploits Across Smart Home and AI Infrastructure
Beyond mobile hardware, the competition featured numerous other targets. Jack Dates of RET2 Systems successfully demoed a Sonos Era 300 exploit chain in under a minute. Meanwhile, HaeJung Yang from the Out of Bounds team was awarded $40,000 for hacking Dynamo in the AI Infrastructure category.
Additional targets included smart home infrastructure and databases. PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Yassine Bengana and Maxence Schmitt of Doyensec also hacked the Home Assistant Green smart home hub. Concurrently, Ikotas Labs breached the Oracle Autonomous AI Database utilizing a seven-chain zero-day exploit.
Competition Rules and Vendor Disclosure Timelines
Trend Micro's Zero Day Initiative (ZDI) organizes the competition to identify zero-day flaws in fully patched devices before malicious actors can exploit them in the wild. Under official Pwn2Own rules, all participating devices run the latest firmware versions, and contestants must successfully compromise the target while demonstrating arbitrary code execution.
Once zero-day vulnerabilities are successfully exploited and disclosed during the event, participating vendors are given a 90-day window to patch their software before ZDI publicly discloses the technical details.
Categories and Upcoming Schedule
Throughout the Pwn2Own Ireland 2026 contest, competitors target products spanning seven distinct categories. These categories encompass mobile phones including the Samsung Galaxy S26 and Google Pixel 10, messaging applications, smart home devices, printers, AI infrastructure, AI coding apps, and a newly introduced category focusing on wellness healthcare devices.
Before the second day of competition began, Kyeongmin Kim officially withdrew his planned attempt at a USB-based attack targeting the Google Pixel 10. Despite the extensive targeting of various devices, no contestants registered an attempt against Apple's iPhone 17, which carried a maximum potential award of $300,000 for a remote hack.
As the competition progresses into its third day, security researchers are scheduled to attempt further hacks against multiple smart home devices, AI infrastructure products, printers, and the Samsung Galaxy S26 and Google Pixel 10 smartphones.
Sources
- BleepingComputerSamsung Galaxy S26 hacked three more times at Pwn2Own Ireland
Continue chronologically
Related stories
Hackers Exploit 32 Zero-Days on Day One of Pwn2Own Ireland
Security researchers earned $388,500 and hacked the Samsung Galaxy S26 twice after exploiting 32 zero-days on the first day of Pwn2Own Ireland 2026.
Google Pixel 10 Exploits Earn Hackers $560,000 at Pwn2Own
Participants at Pwn2Own Ireland 2026 secured over $1.2 million, with Google Pixel 10 exploits earning hackers more than $560,000 across three teams.
Hackers Earn $1.26M for 98 Zero-Days at Pwn2Own Ireland
The Pwn2Own Ireland 2026 hacking contest concluded with researchers earning $1,262,000 in rewards after exploiting 98 zero-day vulnerabilities.
Samsung TVs Use AI for Audio and Ad Tracking
A cybersecurity bounty hunter reverse-engineered a Samsung TV to uncover alarming data collection practices, including audio recording and AI tracking.
