Security researchers earned $232,500 in cash rewards on the second day of Pwn2 Own Ireland 2026 after successfully exploiting 45 unique zero-day vulnerabilities across multiple devices and platforms. The event took place in Dublin on October 8, 2026, drawing top-tier hacking teams from around the world to test the security of consumer technology. Among the most notable targets was Samsung’s latest flagship smartphone, the Galaxy S26, which succumbed to three separate exploits during the competition.
The Galaxy S26 was attacked by a team from KAIST Hackin, a renowned South Korean security group known for its work in mobile vulnerability research. Each successful exploit demonstrated a different attack vector, ranging from kernel-level privilege escalation to bypassing hardware-based security isolation. Researchers noted that despite Samsung’s recent investments in mobile security, including enhanced sandboxing and real-time threat detection, the device remained exposed to chained vulnerabilities that allowed full system compromise. The exploits were demonstrated live before a panel of judges, confirming their validity and triggering immediate bounty payouts under the contest’s rules.
The KAIST Hackin team combined a use-after-free flaw in the device’s display driver with a race condition in the secure boot chain to gain persistent root access. This allowed them to install malicious software capable of accessing encrypted data, microphone input, and location tracking without user interaction. Samsung’s Knox security platform, designed to isolate sensitive operations, was circumvented through a timing attack on its trustlet execution environment. The researchers emphasized that no user action was required to trigger the exploits, making them particularly dangerous in real-world scenarios where attackers could deliver malware via malicious websites or compromised apps.
The repeated success against the Galaxy S26 highlights ongoing challenges in securing complex mobile ecosystems, even when manufacturers implement layered defenses. Industry analysts suggest that the results may push Samsung and other Android OEMs to accelerate adoption of memory-safe programming languages and stricter hardware-enforced isolation. Pwn2 Own organizers noted that the high payout reflects the growing value of mobile zero-days in both defensive and offensive cyber markets. Following the event, Samsung confirmed it is working with the researchers to develop patches, which will be released through its monthly security update cycle.
Was the Galaxy S26 the only device hacked during Pwn2 Own Ireland 2026? No, researchers exploited 45 unique zero-day vulnerabilities across various devices, including laptops, smart home gadgets, and enterprise software, with the Galaxy S26 being one of the most prominently targeted consumer products.
Will Samsung release a fix for the vulnerabilities exploited? Yes, Samsung has acknowledged the findings and stated that patches are in development, to be distributed via its regular security update schedule for affected devices.
Are these exploits a threat to everyday users? The vulnerabilities demonstrated require advanced technical skill and are not currently known to be used in the wild, but they underscore the importance of keeping devices updated to mitigate potential risks.