Researchers exploited 32 zero-days on the first day of Pwn2Own Ireland 2026, BleepingComputer reports. Day one paid out $388,500.
The contest opened October 6. Targets that fell included the Samsung Galaxy S26 (hacked twice), Philips Hue Bridge Pro, Oracle Autonomous AI Database, LiteLLM, Lexmark CX532adwe and Canon imageFORCE 1643F printers, OpenAI Codex and the Sonos Era 300. A Google Pixel 10 attempt did not land within the allotted time.
Vũ Chí Thành and Huỳnh Đức Tin of VinSOC led the board after chaining seven zero-days against the Philips Hue Bridge Pro. They also landed a five-zero-day chain against the Oracle database. Each chain earned $40,000.
Why it matters: the target list now includes AI developer tooling and AI-backed databases alongside phones and printers. LiteLLM and Codex sit in the same pipelines many teams already run. Chained bugs, not single flaws, are what take these systems over.
Nothing here is a patch-now item yet. Under Pwn2Own rules, vendors have 90 days to ship fixes before Trend Micro's Zero Day Initiative discloses the details. Technical write-ups are not public.
Recommended actions: inventory exposure to the affected products, especially LiteLLM and Codex deployments and any Hue Bridge or printers on flat networks. Segment IoT and print devices. Watch vendor advisories over the next 90 days and queue patches as they land.
