On October 6, Cork, Ireland, became the focal point for some of the world’s leading ethical hackers as they convened for the much-anticipated Pwn2Own Ireland event. This highly competitive atmosphere saw various teams taking part in a contest targeting a range of technologies, with the ultimate goal of unearthing novel vulnerabilities. The event, organized by the Zero Day Initiative (ZDI), is renowned for its intense nature, where hackers demonstrate their prowess by exploiting flaws in widely used technologies, including smartphones, smart home devices, printers, and artificial intelligence (AI) tools.
As day one unfolded, participants showcased their exceptional skills, uncovering a staggering 32 zero-day vulnerabilities. This impressive haul was accompanied by a monetary reward exceeding $368,000 and the coveted “Master of Pwn” points, which will be tallied at the event’s conclusion. The hackers’ exploits are pivotal, as they provide invaluable insights into existing security weaknesses, which can then be addressed by vendors to bolster product safety.
The day was marked by a series of remarkable accomplishments among the teams, each employing innovative methods to identify vulnerabilities. Notably, ethical hacker @_McCaulay managed to combine an out-of-bounds write exploit with a format string vulnerability to compromise the Sonos Era 300. Taisic Yun from Xint successfully utilized an improper input validation bug alongside code injection techniques to achieve a reverse shell on LiteLLM. Meanwhile, Vũ Chí Thành and Huỳnh Đức Tin from VinSOC uncovered an impressive seven zero days while targeting the Philips Hue Bridge Pro.
Further demonstrating their expertise, Thanh Do of Team Confused exploited a single use-after-free flaw on the Lexmark CX532adwe. In another remarkable feat, Nam Nguyen, Thanh Vu, and Tin Huynh from VinSOC collaborated to uncover five zero days in their exploitation of the Oracle Autonomous AI Database. Ikotas Labs, Inc. made headlines by using a single argument injection flaw to compromise OpenAI Codex, while Interrupt Labs utilized both an out-of-bounds read and write to exploit the Garmin Index BPM.
In a world where cybersecurity threats are evolving with increasing sophistication, hacking competitions like Pwn2Own have become more crucial than ever. Vendors face mounting pressure to discover vulnerabilities in their products before malicious actors do. The ethical hackers’ findings are responsibly disclosed to relevant vendors, granting them a 90-day grace period to implement necessary updates before ZDI makes the information public. This responsible approach ensures that the integrity of products can be maintained while also safeguarding consumers from potential exploitation.
The rising use of AI tools in vulnerability research has added another layer to this ongoing battle. These tools are increasingly being employed offensively, aiming to identify either new exploits or vulnerabilities that have been previously disclosed. As reported by Google, the landscape of vulnerability disclosures has seen significant growth; numbers soared from 5,045 in January 2026 to 10,477 by July, peaking at 10,740 in August. This underscores the growing importance of vulnerability discovery in an era where technology is advancing rapidly.
Interestingly, AI-driven discovery tends to focus on higher impact flaws. Google’s data has shown that 50% of vulnerabilities identified as likely AI-discovered lead to remote code execution, in stark contrast to just 26% for other Common Vulnerabilities and Exposures (CVEs). However, it is important to contextualize this information within the broader spectrum of vulnerability exploitation; separate studies indicate that a mere 1% of AI-discovered vulnerabilities have been actively exploited in real-world scenarios.
As Pwn2Own continues into October 7 and 8, all eyes will be on the event as participants vie for the title of Master of Pwn. The competition not only highlights the skills of ethical hackers but also plays a crucial role in enhancing cybersecurity measures across countless technologies. With a foundation built on collaboration and responsible disclosure, Pwn2Own offers a glimpse into the future of cybersecurity, urging vendors and researchers alike to stay ahead of evolving threats.