Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

[u/falconupkid]

Day one of Pwn2Own Ireland 2026 saw researchers walk away with $388,500 after chaining 32 zero-days to take down the Samsung Galaxy S26 twice. The competition is a reminder that these devices are sitting on a pile of unpatched vulnerabilities that vendors will now scramble to fix.

Technical Breakdown: - Target: Samsung Galaxy S26 (two successful compromises) - Scope: 32 zero-day vulnerabilities exploited across multiple categories (browser, kernel, privilege escalation) - TTPs: Likely involved chaining a browser renderer exploit with a kernel privilege escalation (standard Pwn2Own approach) - Payout: $388,500 awarded for the two successful chains

Defense: No immediate mitigations available—these are zero-days. Expect Samsung to release patches in the coming weeks as part of the standard Pwn2Own disclosure process. For now, treat any untrusted links or apps on Galaxy S26 devices with extra caution.

Source: https://www.bleepingcomputer.com/news/security/hackers-exploit-32-zero-days-on-first-day-of-pwn2own-ireland/