Pwn2Own Ireland 2026 Uncovers 98 Zero‑Day Flaws Across Mobile, AI, and IoT Devices
What Happened — Hackers demonstrated 98 previously unknown zero‑day vulnerabilities during the three‑day Pwn2Own Ireland contest, earning a total of $1,262,000 in rewards. The flaws spanned mobile phones (Samsung Galaxy S26, Google Pixel 10), AI infrastructure and coding tools (OpenAI Codex, Oracle Autonomous AI Database), smart‑home devices, printers, and emerging wellness‑healthcare hardware.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability discovery highlights the need for an ongoing, evidence‑driven patch‑management program that can be audited at any moment.
- Demonstrated zero‑days create a “control gap” that must be documented, mitigated, and tracked to satisfy multiple framework objectives (e.g., change management, vulnerability remediation).
- Verisq’s Control Mapping capability lets organizations map each newly disclosed flaw to the relevant control objectives, capture remediation evidence, and produce a defensible audit trail.
Who Is Affected – Mobile OEMs, AI platform providers, smart‑home manufacturers, printer vendors, and developers of emerging health‑tech devices.
Recommended Actions
- Update your asset inventory with the product list disclosed by Pwn2Own and tag any matching assets.
- Prioritize remediation of the disclosed zero‑days, documenting patch status and timelines as continuous control evidence.
- Integrate a control‑mapping layer that links each vulnerability to the appropriate VCF control area (e.g., vulnerability management, change control).
Source: BleepingComputer
Technical Notes – Contest rules required devices to run the latest firmware; exploits achieved arbitrary code execution. Vendors have a 90‑day window to release patches before ZDI publishes details.
Source: same as above