Some of the world’s best security researchers spent three days last week breaking into fully updated smartphones, smart speakers, printers and AI tools — and they were paid handsomely for it. Pwn2Own Ireland 2026, held in Cork, ended on October 8 with $1,262,000 in rewards for 98 previously unknown security flaws, known as zero-days, according to BleepingComputer.

Both of the year’s flagship Android phones fell. Google’s Pixel 10 was hacked three times on the final day, and Samsung’s Galaxy S26 was compromised in every attempt made against it.

That sounds alarming, but it’s exactly how the contest is supposed to work.

What Is Pwn2Own?

Pwn2Own is a hacking competition run by Trend Micro’s Zero Day Initiative (ZDI). Researchers sign up to attack popular devices and software. To win, they must break into products running the latest firmware and software and show they can run their own code on them.

The key is what happens next. ZDI shares the details of every successful attack with the company that makes the product. Vendors then have 90 days to fix the flaw before ZDI publishes technical details. In other words, the hackers get paid to find problems before criminals do, and users get the fixes.

A Record Haul

This year’s Ireland event was bigger than the last. The 2025 contest produced 73 zero-days and $1,024,750 in prizes. In 2026, researchers found 98 zero-days and collected $1,262,000.

The money was spread across three days:

  • Day one: 32 zero-days for $388,500
  • Day two: 45 zero-days for $232,500
  • Day three: 21 zero-days for $641,000

In total, 29 research teams targeted products in seven categories: mobile phones, AI infrastructure, AI coding apps, messaging apps, smart home devices, printers and, new this year, wellness and healthcare devices. According to The Hacker News, 51 of 63 scheduled attempts succeeded.

The Pixel 10 Falls Three Times

The biggest moment came on day three, when three separate teams remotely hacked Google’s Pixel 10. All three were remote attacks, meaning they came through web content in the default browser or one of the phone’s wireless links, such as Wi-Fi, Bluetooth, NFC or the cellular modem, The Hacker News reported.

  • Ikotas Labs chained multiple flaws together and won the top prize of $300,000.
  • Xint (Tim Becker and Yves Bieri) earned $150,000.
  • Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara earned $112,500.

A fourth attempt ran out of time. In total, Pixel 10 exploits earned researchers more than $560,000.

Some of these entries were labeled “collisions,” which means at least one of the bugs used was already known to the vendor or the organizers. Collisions still count, but they earn smaller rewards.

The Galaxy S26 Didn’t Survive a Single Attempt

Samsung’s Galaxy S26 had a rough week. It was hacked on all three days and exploited in all seven attempts against it. On day two alone, it fell to three different teams: Kyeongmin Kim of KAIST Hacking Lab, PetoWorks, and the trio of Valsamaras, Gannon and Valsamara from CENSUS Labs.

There is a silver lining for Samsung. Six of the seven winning entries used at least one bug that was already known, according to The Hacker News. That suggests Samsung was aware of some of the problems but hadn’t shipped fixes yet.

AI Tools and Smart Homes Were Also Targets

Phones weren’t the only devices to fall. Ikotas Labs, which was crowned “Master of Pwn” with 42.5 points and $361,000 in winnings, also broke into OpenAI’s Codex coding tool and Oracle’s Autonomous AI Database.

Other notable results included:

  • Jack Dates of RET2 Systems hacked a Sonos Era 300 speaker in under a minute.
  • The Home Assistant Green smart home hub was hacked by several teams.
  • A VinSOC team earned $40,000 for a seven-flaw chain against a Philips Hue Bridge Pro.
  • Printers from Lexmark, Canon and Brother were also targeted.

Xint finished second overall with $240,000, and Team ZyGoat finished third with $125,000.

Why No One Went After the iPhone

One device stood out for the attacks it didn’t get. The Apple iPhone 17 was on the target list with a maximum reward of $300,000 for a remote hack, but no contestant registered to try. No attempts were scheduled against WhatsApp either.

That doesn’t prove the iPhone is unhackable. Researchers who find serious iPhone flaws may choose to sell them elsewhere or report them through Apple’s own bug bounty program. But it’s notable that no team brought an exploit to the event.

What This Means for You

If you own a Pixel 10 or Galaxy S26, there’s no need to panic. The details of these attacks are private and are now in the hands of Google and Samsung. Fixes should arrive in upcoming security updates, likely well within the 90-day window.

The best thing you can do is keep your phone updated. Google released its October Pixel security update on October 6, two days before the contest’s final day, so the fixes for these new flaws will come in a later update. Separately, Google patched a Pixel modem flaw in September that it said “may be under limited, targeted exploitation.” Pixel phones with the September 5, 2026, security patch or later already include that fix.

Pwn2Own is a reminder that every connected device has weaknesses. The good news is that this week, the people who found them were on your side.