The first day of Pwn2Own Ireland 2026 delivered a reminder that even the newest flagship hardware and the latest generation of AI-connected services remain full of unknown security holes. Trend Micro’s Zero Day Initiative (ZDI), which runs the contest, confirmed that competing teams successfully demonstrated 32 unique zero-day vulnerabilities on October 6, 2026, earning a combined $388,500 in payouts across 21 recognized entries.

Flagship Phones Split Between Falls and Survivals

Samsung’s new Galaxy S26 was the day’s most popular target, and it did not escape unscathed. Three separate teams successfully compromised the device, each chaining four bugs together. Vietnam’s Viettel Cyber Security led the pack, earning $31,250 for a chain that combined one freshly discovered flaw with three bugs Samsung already knew about. Interrupt Labs followed with $15,750 for a single new vulnerability plus three “collisions” — bugs independently found by more than one team, which reduces the payout even though ZDI still credits the working exploit. Ikotas Labs rounded out the Galaxy S26 results with $11,000 for three new bugs and one previously unpatched issue.

Google’s Pixel 10 fared better, at least on paper. A team from White Noise Club ran out of time before completing their exploit chain against the device. ZDI was careful to note that a failed attempt under contest time pressure doesn’t mean the phone is free of exploitable issues — it simply means this particular chain wasn’t finished in the allotted window.

AI Services Prove Just as Breakable as Traditional Software

Two of the day’s targets reflected how deeply AI tooling has now been folded into the contest’s scope. OpenAI’s Codex coding assistant fell to a single argument-injection flaw from Ikotas Labs, worth $40,000 — one of the day’s largest single payouts, though ZDI withheld technical specifics pending a fix. LiteLLM, a popular open-source gateway used to route calls to large language models, was hit twice: researcher Taisic Yun of Xint earned $40,000 by pairing improper input validation with code injection to pop a reverse shell, while a second team, Out of Bounds, chained four bugs (two previously known) for an additional $15,000.

Oracle’s Autonomous AI Database also went down, with VinSOC stringing together five separate flaws for a $40,000 payout — the same team’s attempt against the Chroma vector database ran out of time before completion.

Smart Home and Connected Devices Add Up

Consumer hardware outside the phone category contributed heavily to the day’s zero-day count. VinSOC researchers Vũ Chí Thành and Huỳnh Đức Tin disclosed seven distinct zero-days in the Philips Hue Bridge Pro alone, worth $40,000, while other attempts against the same hub largely reused already-known issues. Sonos’ Era 300 speaker fell to McCaulay Hudson, who combined an out-of-bounds write with a format-string vulnerability for $50,000 — the single richest reward of the day. Garmin’s Index BPM smart scale yielded $20,000 for Interrupt Labs via a combined out-of-bounds read and write, and Lexmark’s CX532adwe printer was separately compromised by Team Confused’s Thanh Do and by Sina Kheirkhah of Summoning Team, though no payout figures were disclosed for those entries.

Why the Scorecard Matters

Across the vulnerability classes involved — argument injection, input validation failures, code injection, and memory-safety bugs like out-of-bounds reads, writes, and format-string errors — the common thread is how ordinary these bug types are, even in products built by well-resourced vendors in 2026. ZDI’s contest rules require vendors to be notified immediately and given a fixed window to patch before any technical detail becomes public, which is why none of Wednesday’s winning chains come with proof-of-concept code attached.

That disclosure process is also the central safety valve here: nothing demonstrated at Pwn2Own has been seen used against real users, and the contest format exists specifically to get these bugs into vendors’ hands before criminal groups find them independently. Still, the sheer volume — 32 unique issues in a single day, spanning phones, AI infrastructure, and smart-home devices — is a useful gut check for any organization that assumes its newest hardware or its AI vendor’s gateway is inherently hardened. ZDI has indicated further results will be published as the remaining two days of the contest conclude, and security teams running any of the affected products should watch vendor advisories closely in the weeks ahead for the patches these findings will eventually produce.