Trend Micro's Zero Day Initiative (ZDI) runs Pwn2Own Ireland 2026 from 6 October. Day one (BleepingComputer: 32 zero-days, US$388,500) included VinSOC chaining five bugs against the Oracle Autonomous AI Database and seven zero-days against the Philips Hue Bridge Pro (US$40,000 each); Ikotas Labs exploiting the OpenAI Codex cloud coding agent with one argument-injection bug (US$40,000); Xint's Taisic Yun and Out of Bounds both winning against the LiteLLM AI gateway; McCaulay Hudson on the Sonos Era 300 (US$50,000); Lexmark CX532adwe printer wins; and Interrupt Labs taking the first wellness-category win on the Garmin Index BPM blood pressure monitor.

Day two (7 October; BleepingComputer: 45 unique zero-days, US$232,500) saw the Galaxy S26 compromised three more times, by Mobile Hacking Lab and CENSUS Labs researchers with a single confused-deputy bug, by KAIST Hacking Lab's Kyeongmin Kim remotely with one new bug and two known ones, and by PetoWorks. HaeJung Yang of Out of Bounds won US$40,000 against Dynamo in the AI infrastructure category; Ikotas Labs used a seven-bug chain ending in a use-after-free and type confusion against Oracle Autonomous AI Database, and Xint's Taisic Yun also beat it with two new bugs; Home Assistant Green fell to Xint's Yves Bieri (US$30,000), PetoWorks, Kyeongmin Kim and Doyensec (all known bugs); McCaulay Hudson used hard-coded credentials, missing authentication and command injection on a Canon imageFORCE 1643F; and Interrupt Labs and Zellic/v12 each beat the Lexmark CX532adwe.

Attempts on a Brother printer, Chroma and one Home Assistant entry failed, and no one registered for the iPhone 17.

UPDATE (9 Oct, final day): ZDI's day-three results and BleepingComputer report 21 more zero-days and US$641,000 on 8 October, for a contest total of US$1,262,000 and 98 zero-days from 29 teams (2025: 73 zero-days, US$1,024,750). The Google Pixel 10 fell three times: Ikotas Labs took the top US$300,000 award with a remote multi-bug chain, Xint's Tim Becker and Yves Bieri earned US$150,000 (one known bug), and Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara earned US$112,500 (one zero-day plus one known bug).

BunkyoWesterns hit the Galaxy S26 again; FuzzingLabs beat the Brother MFC-L8970CDW with one zero-day (US$20,000); Summoning Team beat the Canon imageFORCE 1643F; Team MAMMOTH used six zero-days on Home Assistant Green; and further entries against the Philips Hue Bridge Pro, Oracle Autonomous AI Database and Lexmark CX532adwe were partial collisions. A Garmin Index BPM attempt failed. Ikotas Labs won Master of Pwn with 42.5 points and US$361,000, ahead of Xint (US$240,000) and Team ZyGoat (US$125,000).

No one tried the iPhone 17 or WhatsApp (US$300,000 each). Vendors have 90 days to ship fixes before ZDI publishes details; no CVEs have been assigned yet. Primary: ZDI; wire: BleepingComputer.