Hackers Earned Over $1.2 Million Finding Zero-Days at Pwn2Own

Key takeaways

• Security researchers found 98 zero-day vulnerabilities in fully patched flagship phones at Pwn2Own Ireland.
• Pwn2Own operates under responsible disclosure, so all discovered flaws are shared with vendors for patching.
• Zero-days are dangerous because no fix exists yet, but automatic updates will close these holes once patches ship.
• Business owners should enforce automatic security updates and use mobile device management to limit damage from compromised phones.
• Contests like Pwn2Own channel vulnerability discoveries toward fixes instead of black-market exploitation.

What Happened

The Pwn2Own Ireland 2026 hacking contest wrapped up (https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/) on October 9 in Cork, with security researchers walking away with $1,262,000 in total prize money. Over the course of the competition, teams demonstrated working exploits for 98 zero-day vulnerabilities. A zero-day is a security flaw the manufacturer does not yet know about and therefore has not patched.

Three separate research teams successfully broke into Google's Pixel 10 (https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html) on October 8, with each phone running the latest security updates. Ikotas Labs earned the contest's top prize of $300,000 for one of those Pixel exploits, making them the overall winner. Samsung's Galaxy S26 was also hacked multiple times (https://www.bleepingcomputer.com/news/security/samsung-galaxy-s26-hacked-three-more-times-at-pwn2own-ireland/), with researchers collecting $232,500 on the second day alone after exploiting 45 unique zero-day vulnerabilities.

The Pwn2Own contest requires every target device to be fully patched. That means these vulnerabilities existed in phones running the most current security software available.

Why This Is an Issue

Zero-days are the most dangerous kind of vulnerability because there is no fix yet. When attackers discover them first, they can exploit devices before manufacturers even know a problem exists. The good news here is that Pwn2Own operates under responsible disclosure rules: the contest organizers share every discovered flaw with the affected vendors so they can develop patches.

Still, the sheer volume is notable. Ninety-eight unknown flaws across a handful of device models signals that even flagship products from major manufacturers ship with exploitable weaknesses. For business owners, this matters because your employees likely carry these devices. They use them to read email, access company systems, and handle sensitive data. A compromised phone can become a doorway into your network.

The contest also demonstrates that skilled attackers can chain multiple small vulnerabilities together into a working exploit. One flaw might let an attacker read memory they should not access. A second might let them run code. Combined, those turn into remote device takeover. Patching stops known exploits, but it does not prevent the next zero-day.

What You Can Do About It

First, make sure every device in your business is set to install security updates automatically. Vendors will patch the vulnerabilities found at Pwn2Own, but only if your devices actually receive those updates. On Android, check Settings > Security > Security update. On iOS, go to Settings > General > Software Update and enable automatic updates.

Second, enforce basic mobile device hygiene. Require PINs or biometric locks. Use mobile device management software if you issue phones to staff or allow personal devices to access company data. This lets you remotely wipe a lost or stolen phone and enforce encryption.

Third, segment access. Not every employee needs full network access from their phone. Use a VPN for remote access and limit what resources are reachable from mobile devices. If a phone is compromised, you want to contain the damage.

Fourth, watch for signs of trouble. Unexpected battery drain, unexplained data usage, or apps behaving strangely can signal a device has been tampered with. Make it easy for employees to report anything odd without fear they will be blamed.

Finally, understand that zero-days are part of the threat landscape. You cannot patch what is not yet known, so your security posture needs to assume devices may be compromised. That means logging access, monitoring for anomalies, and having an incident response plan ready.

Where This Is Heading

Pwn2Own and similar contests play an important role in the security ecosystem. By paying researchers more than black-market buyers would, they channel vulnerability discoveries toward fixes instead of exploitation. The contest organizers, Trend Micro's Zero Day Initiative, have run events like this for years, and the prize pools keep growing.

Manufacturers benefit too. Google and Samsung now have a detailed list of 98 flaws to fix. They will release patches in the coming weeks and months. The teams that found these issues earned recognition and payment. The rest of us get more secure devices.

Expect the contest to continue and the payouts to rise. As devices become more central to both personal and business life, the value of securing them increases. The fact that three separate teams could break into a fully patched Pixel 10 suggests there is still plenty of work to do.

For now, turn on automatic updates, enforce device policies, and plan for the next zero-day. Because there will always be a next one.