Samsung Galaxy S26 hacked multiple times at Pwn2Own Ireland
Security researchers exposed multiple zero-day vulnerabilities in Samsung's flagship phone, securing thousands in cash prizes.
What happened to the Galaxy S26?
Security researchers have compromised the newly released Samsung Galaxy S26 multiple times at the Pwn2Own Ireland 2026 hacking competition, exposing critical zero-day vulnerabilities in the flagship device.
On the second day of the contest, the Galaxy S26 was breached three separate times. The successful attacks were carried out by Kyeongmin Kim of the KAIST Hacking Lab, the security group PetoWorks, and a team comprising Dimitrios Valsamaras, Ken Gannon, and Tenia Valsamara from CENSUS Labs.
These breaches followed an active opening day, during which Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security also managed to compromise the phone. While some of the vulnerabilities exploited on the first day were already known to Samsung, the subsequent day-two attacks relied on entirely new, unpatched security flaws.
How the competition works
The Pwn2Own contest, organised by Trend Micro's Zero Day Initiative (ZDI), is designed to find and patch security vulnerabilities before cybercriminals can exploit them. To win, researchers must demonstrate arbitrary code execution on fully updated devices running the latest firmware.
Over the course of the event, contestants targeted devices across seven categories, including mobile phones, smart home systems, messaging apps, and printers.
Once a researcher successfully demonstrates a zero-day exploit, the details are shared privately with the manufacturer. Under Pwn2Own rules, Samsung and other affected vendors have 90 days to develop and distribute security patches before ZDI publicly discloses the technical details of the bugs.
Other major targets
The Galaxy S26 was not the only high-profile target to fall. Researchers collected a total of $232,500 on the second day of the event after exploiting 45 unique zero-day vulnerabilities across various devices.
Among the other highlights, Jack Dates of RET2 Systems demonstrated an exploit chain on a Sonos Era 300 smart speaker in less than a minute. HaeJung Yang of the Out of Bounds team secured a $40,000 reward for breaching Dynamo in the AI infrastructure category, while Ikotas Labs broke into the Oracle Autonomous AI Database using a complex seven-chain exploit.
On the smart home front, the Home Assistant Green hub was breached by several researchers, including PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, and a team from Doyensec.
Google's Pixel 10 was also on the list of mobile targets, though researcher Kyeongmin Kim withdrew a planned USB-based exploit attempt before the second day's hacking sessions began.
Notably, Apple's iPhone 17 was available as a target with a $300,000 reward for a remote compromise, but no researchers registered to attempt a hack on it.
Key numbers
| What | Figure | Source |
|---|---|---|
| Day 2 cash awards | $232,500 | Zero Day Initiative |
| Unique zero-day vulnerabilities exploited on Day 2 | 45 | Zero Day Initiative |
| Out of Bounds team prize for Dynamo breach | $40,000 | Zero Day Initiative |
| Maximum bounty offered for a remote iPhone 17 compromise | $300,000 | Zero Day Initiative |
In this story
| Name | Role in the story |
|---|---|
| Samsung | Manufacturer of the Galaxy S26 smartphone targeted by hackers |
| Pwn2Own Ireland 2026 | The hacking competition where the zero-day exploits were demonstrated |
| Samsung Galaxy S26 | The flagship smartphone hacked multiple times during the competition |
