Samsung’s flagship Galaxy S26 has become one of the most frequently compromised devices at Pwn2Own Ireland 2026, with security researchers successfully hacking the smartphone five times during the competition’s first two days.
The latest demonstrations took place on October 7, when three separate research teams compromised the device. The attacks followed two successful attempts on the opening day, highlighting how even fully updated flagship smartphones can contain vulnerabilities that remain undiscovered by their manufacturers.
Across the competition’s second day, researchers demonstrated 45 unique zero-day vulnerabilities and earned $232,500 in cash prizes, targeting everything from smartphones and smart home devices to artificial intelligence infrastructure.
Samsung’s Flagship Faces Repeated Attacks
The Galaxy S26 attracted considerable attention throughout the competition. On the second day, successful attacks came from Kyeongmin Kim of KAIST Hacking Lab, researchers from PetoWorks, and a team comprising Dimitrios Valsamaras, Ken Gannon, and Tenia Valsamara of CENSUS Labs.
Their demonstrations followed successful attacks by Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security on the opening day. Some vulnerabilities exploited during those earlier attempts were already known to Samsung, although the competition still demonstrated their potential security impact.
The results do not mean that Galaxy S26 devices are currently being compromised in widespread attacks. Pwn2Own operates in a controlled environment, where researchers demonstrate vulnerabilities under specific conditions and privately disclose their findings to the affected vendors.
Nevertheless, five successful compromises in two days illustrate the complexity of securing modern smartphones, even when manufacturers deploy the latest available software and firmware.
AI Infrastructure Becomes a Major Target
While Samsung dominated the mobile headlines, some of the competition’s most interesting discoveries involved artificial intelligence infrastructure.
HaeJung Yang of the Out of Bounds team received $40,000 for successfully compromising Dynamo, an AI infrastructure target. Researchers from Ikotas Labs also demonstrated an attack against Oracle Autonomous AI Database using a chain of seven zero-day vulnerabilities.
These findings reflect a broader shift in cybersecurity research. As AI systems become integrated into enterprise environments, the infrastructure supporting them is emerging as another valuable attack surface.
AI platforms increasingly connect databases, cloud resources, inference services and applications. Vulnerabilities in these components can potentially expose sensitive information or provide attackers with access to systems supporting critical business operations.
The competition demonstrates that securing AI requires more than evaluating model behavior. The surrounding software, infrastructure and integrations need the same rigorous security testing as conventional enterprise systems.
Smart Home Devices Remain Vulnerable
Connected devices also featured prominently in the second day’s results.
Jack Dates of RET2 Systems demonstrated an exploit chain against the Sonos Era 300 smart speaker in less than a minute. Meanwhile, several researchers successfully compromised the Home Assistant Green smart home hub, including participants from PetoWorks, Xint and Doyensec.
The speed of the Sonos demonstration is particularly striking, although a rapid execution does not necessarily mean the underlying exploit was simple to discover or develop.
Smart home products present a persistent security challenge because they combine network connectivity, embedded software and increasingly complex integrations with other devices.
Unlike smartphones and computers, many connected devices receive less attention from users after installation. They may remain connected to home or business networks for years, making reliable security updates essential.
Why Pwn2Own Matters
Organized by Trend Micro’s Zero Day Initiative, Pwn2Own is designed to discover vulnerabilities before malicious actors can exploit them.
Participating devices run current firmware, and researchers must demonstrate successful exploitation, including arbitrary code execution, under the competition’s rules.
Once vulnerabilities are demonstrated, vendors receive technical details and generally have 90 days to develop security updates before the Zero Day Initiative publicly discloses the findings.
That process creates an important distinction between responsible vulnerability research and criminal exploitation. Researchers receive financial rewards for demonstrating weaknesses, while manufacturers gain an opportunity to correct them before the technical details become public.
The competition also provides a rare view of how much undiscovered security risk can remain inside widely used products.
The Challenge of Securing Modern Technology
Pwn2Own Ireland 2026 is testing products across seven categories, including mobile phones, messaging applications, smart home devices, printers, AI infrastructure, AI coding applications and wellness healthcare devices.
The Google Pixel 10 is also among the mobile targets, although one planned USB-based attack was withdrawn before the second day’s demonstrations. Apple’s iPhone 17 was eligible for a remote exploitation award of up to $300,000, but no researcher registered an attempt.
The absence of an iPhone demonstration should not be interpreted as evidence that the device is more secure. Competition results depend on which researchers participate, what vulnerabilities they have discovered and which attacks they choose to demonstrate.
For perspective, Pwn2Own Ireland 2025 produced 73 demonstrated zero-day vulnerabilities and awarded more than $1 million in prizes.
This year’s results reinforce a familiar but increasingly important cybersecurity lesson: software complexity continues to create opportunities for attackers, regardless of how mature or well-funded the manufacturer may be.
The Galaxy S26’s repeated compromises are significant, but the larger story extends beyond Samsung. Smartphones, AI platforms, databases and connected devices are all becoming more capable — and more interconnected.
Pwn2Own demonstrates that even fully patched technology can contain serious vulnerabilities. The difference is whether those weaknesses are discovered by security researchers working with vendors or by attackers seeking to exploit them first.