Summary
Pwn2Own Ireland 2026 has concluded with a final total of $1,262,000 awarded to researchers for 98 zero-day vulnerabilities demonstrated across the competition’s full run. TTO-2026-1007-219 documented 32 zero-days and $700,000 in awards on day one; the competition continued for additional days with researchers demonstrating further vulnerabilities in NAS devices, routers, printers, IP cameras, and mobile devices. The 98 zero-day total represents one of the highest single-competition zero-day counts in Pwn2Own history.
Timeline
| Date | Event |
|---|---|
| Oct 7, 2026 | Pwn2Own Ireland day one: 32 zero-days, $700K+ awarded; TTO-2026-1007-219 published |
| Oct 8-9, 2026 | Competition continues; additional zero-days demonstrated across all target categories |
| Oct 9, 2026 | Final results published: 98 zero-days, $1,262,000 total awarded; BleepingComputer reports |
What Changed
The final 98 zero-day count across the full competition confirms the pattern established on day one: the attack surface of SOHO and enterprise network-connected devices remains densely populated with exploitable vulnerabilities. 98 zero-days demonstrated in a single competition, across devices from multiple major vendors, indicates that the security investment in network-connected device firmware has not kept pace with the sophistication of vulnerability research. Under Pwn2Own’s coordinated disclosure rules, all 98 vendors have been notified and are now under the fixed disclosure window within which they must release patches before full technical details are published. Organizations should monitor patch releases from the affected vendors over the coming weeks and prioritize updates for NAS, router, printer, and camera models represented in the competition.
Note on Domain Intelligence
Pwn2Own Ireland is a research competition. No single victim domain is the primary subject of this bulletin.