Posts of last few hours

Fáilte! Pwn2Own Ireland 2026 has arrived in Cork, and the world's top security researchers are ready. We've got more phone entries than we've ever had, and more than 60 entries total.

Earlier today, we held the random draw to determine attempt order. Below is the official schedule. All times are Irish Standard Time (IST) and may change as the competition progresses. You can find our live leaderboard here. This will be updated throughout the day.

Jump to:

Day One

Day Two

Day Three

Tuesday, October 6 - 9:30 AM

Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

@_McCaulay targeting Sonos Era 300 in the Smart Home category for a total of $50,000 and 5 Master of Pwn points

Taisic Yun (@taisic_) of Xint (@xint_official) targeting LiteLLM in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Ikotas Labs, Inc. targeting Brother MFC-L8970CDW in the Printers category for a total of $20,000 and 2 Master of Pwn points

Tuesday, October 6 - 11:15 AM

HaeJung Yang (@haehaeYang), and ByungYoung Yi (@yibarrack) of Out of Bounds (@oobs_io) targeting LiteLLM in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Tuesday, October 6 - 11:45 AM

linhlhq (@linhlhq) and Son Dinh (@sondt) of VinSOC targeting Sonos Era 300 in the Smart Home category for a total of $50,000 and 5 Master of Pwn points

Interrupt Labs (@InterruptLabs) targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

Hyeop Jung (@hyoub9un), Hyunwoo Kim (@hwhw_kr), Jinyoung Choi (@hmema_), and Jihun Lee (@dyrandy_) of Team T-X Lab (@TX_Lab_) targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Tuesday, October 6 - 2:00 PM

Vũ Chí Thành (@vcth4nh) and Huỳnh Đức Tin (@ductinm) of VinSOC targeting Philips Hue Bridge Pro in the Smart Home category for a total of $40,000 and 4 Master of Pwn points

Tuesday, October 6 - 2:30 PM

Aaron Christophel (@ATC1441) of Summoning Team (@SummoningTeam) targeting Garmin Index BPM in the Wellness category for a total of $20,000 and 2 Master of Pwn points

Thanh Do (@nyanctl) of Team Confused targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Ikotas Labs, Inc. targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

Tuesday, October 6 - 4:15 PM

ByungYoung Yi (@yibarrack), and KeunHo Kim (@gn0sis__) of Out of Bounds (@oobs_io) targeting Philips Hue Bridge Pro in the Smart Home category for a total of $40,000 and 4 Master of Pwn points

Nam Nguyen (@namberinos), Thanh Vu (@vcth4nh), and Tin Huynh (@ductinm) of VinSOC targeting Oracle Autonomous AI Database in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Interrupt Labs (@InterruptLabs) targeting Garmin Index BPM in the Wellness category for a total of $20,000 and 2 Master of Pwn points

Tuesday, October 6 - 4:45 PM

Sina Kheirkhah (@SinSinology) of Summoning Team targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Tuesday, October 6 - 5:15 PM

Mikhail Evdokimov (@konatabrk), Polina Smirnova (@moe_hw) and Mate Zombor (@r4bbit_zm) of White Noise Club targeting Google Pixel 10 - Remote in the Mobile Phone category for a total of $300,000 and 30 Master of Pwn points

Tuesday, October 6 - 6:00 PM

Ikotas Labs, Inc. targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Tuesday, October 6 - 6:30 PM

Nam Nguyen (@namberinos) and Thai Son Dinh (@sondt) and Hoang Tien Minh (@cr0nica1) of VinSOC targeting Chroma in the AI Infrastructure category for a total of $20,000 and 2 Master of Pwn points

Joohyun Park (@cdor1) of Xint (@xint_official) targeting Philips Hue Bridge Pro in the Smart Home category for a total of $40,000 and 4 Master of Pwn points

Tuesday, October 6 - 7:00 PM

Cong Thanh (@ExLuck99), Duc Hieu (@gr4ss341) and Nam Dung (@greengrass19000) targeting Canon imageFORCE 1643F Multifunction Copier in the Printers category for a total of $20,000 and 2 Master of Pwn points

Back to top

Wednesday, October 7 - 9:30 AM

Kyeongmin Kim (@hareh4ru) of KAIST Hacking Lab targeting Google Pixel 10 - USB in the Mobile Phone category for a total of $75,000 and 7.5 Master of Pwn points

HaeJung Yang (@haehaeYang) of Out of Bounds (@oobs_io) targeting Dynamo in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Thanh Do (@nyanctl) of Team Confused targeting Brother MFC-L8970CDW in the Printers category for a total of $20,000 and 2 Master of Pwn points

Yves Bieri (@yves_bieri) of Xint (@xint_official) targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Wednesday, October 7 - 10:30 AM

Eugene (@k3vg3n) targeting Chroma in the AI Infrastructure category for a total of $20,000 and 2 Master of Pwn points

Wednesday, October 7 - 11:15 AM

Team: Yassine Bengana (@cousky_), and Maxence Schmitt (@maxenceschmitt) of Doyensec (@doyensec) targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Wednesday, October 7 - 11:45 AM

@_McCaulay targeting Canon imageFORCE 1643F Multifunction Copier in the Printers category for a total of $20,000 and 2 Master of Pwn points

Jack Dates of RET2 Systems (@ret2systems) targeting Sonos Era 300 in the Smart Home category for a total of $50,000 and 5 Master of Pwn points

Wednesday, October 7 - 1:00 PM

Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@yogehi) using Djini.ai from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

Taisic Yun (@taisic_) of Xint (@xint_official) targeting Oracle Autonomous AI Database in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Wednesday, October 7 - 1:30 PM

Shio Kudo (@shiosa1t) of GMO Flatt Security Inc. (@flatt_security) targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Wednesday, October 7 - 2:30 PM

Nguyen Thanh Dat (@rewhiles), dungnm (@dungnm_) of Viettel Cyber Security (@vcslab) targeting Sonos Era 300 in the Smart Home category for a total of $50,000 and 5 Master of Pwn points

Interrupt Labs (@InterruptLabs) targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Wednesday, October 7 - 3:15 PM

Kyeongmin Kim (@hareh4ru) of KAIST Hacking Lab targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

PetoWorks (@petoworks) targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Wednesday, October 7 - 3:30 PM

Ikotas Labs, Inc. targeting Oracle Autonomous AI Database in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Wednesday, October 7 - 4:45 PM

@_McCaulay targeting Garmin Index BPM in the Wellness category for a total of $20,000 and 2 Master of Pwn points

Adam Hansen of Zellic (@zellic_io) targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Wednesday, October 7 - 5:30 PM

Kyeongmin Kim (@hareh4ru) of KAIST Hacking Lab targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

PetoWorks (@petoworks) targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

Wednesday, October 7 - 5:45 PM

Mingeun Kim, Chulhan Park, SeokHun Lee, Inhyung Lee, Sehyun Baek, Nayeon Lee, Junseok Kim of Team MAMMOTH targeting Chroma in the AI Infrastructure category for a total of $20,000 and 2 Master of Pwn points

Wednesday, October 7 - 6:30 PM

Sina Kheirkhah (@SinSinology) of Summoning Team targeting Sonos Era 300 in the Smart Home category for a total of $50,000 and 5 Master of Pwn points

Wednesday, October 7 - 7:00 PM

@BoredPentester targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Wednesday, October 7 - 7:15 PM

@_McCaulay targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Wednesday, October 7 - 7:30 PM

Alessandro Fanio Gonzalez targeting Chroma in the AI Infrastructure category for a total of $20,000 and 2 Master of Pwn points

Back to top

Thursday, October 8 - 10:00 AM

Sina Kheirkhah (@SinSinology) and Aaron Christophel (@ATC1441) of Summoning Team (@SummoningTeam) targeting Philips Hue Bridge Pro in the Smart Home category for a total of $40,000 and 4 Master of Pwn points

Nikolaos Mourousias (@deltaclock) and Bruno Halltari (@BrunoModificato) of OtterSec targeting Oracle Autonomous AI Database in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Polina Smirnova (@moe_hw), Mikhail Evdokimov (@konatabrk) and Mate Zombor (@r4bbit_zm) of White Noise Club targeting Garmin Index BPM in the Wellness category for a total of $20,000 and 2 Master of Pwn points

Lucas Van Haaren (vhash, @LucasVanHaaren) and Hugo Leclercq (0xnasu) of FuzzingLabs (@FuzzingLabs) targeting Brother MFC-L8970CDW in the Printers category for a total of $20,000 and 2 Master of Pwn points

Thursday, October 8 - 11:15 AM

Tim Becker (@tjbecker) and Yves Bieri (@yves_bieri) of Xint (@xint_official) targeting Google Pixel 10 - Remote in the Mobile Phone category for a total of $300,000 and 30 Master of Pwn points

Thursday, October 8 - 12:15 PM

Ben Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Thursday, October 8 - 1:00 PM

Connor Laidlaw & Matthew Keeley of Platform Security targeting Oracle Autonomous AI Database in the AI Infrastructure category for a total of $40,000 and 4 Master of Pwn points

Sina Kheirkhah (@SinSinology) and Aaron Christophel (@ATC1441) of Summoning Team (@SummoningTeam) targeting Canon imageFORCE 1643F Multifunction Copier in the Printers category for a total of $20,000 and 2 Master of Pwn points

Thursday, October 8 - 2:00 PM

Ikotas Labs, Inc. targeting Google Pixel 10 - Remote in the Mobile Phone category for a total of $300,000 and 30 Master of Pwn points

Thursday, October 8 - 2:30 PM

@_McCaulay targeting Philips Hue Bridge Pro in the Smart Home category for a total of $40,000 and 4 Master of Pwn points

Thursday, October 8 - 3:15 PM

Cong Thanh (@ExLuck99), Duc Hieu (@gr4ss341) and Nam Dung (@greengrass19000) targeting Brother MFC-L8970CDW in the Printers category for a total of $20,000 and 2 Master of Pwn points

Rintaro Kawasugi (@fubukiyokiyoki) of GMO Flatt Security Inc. (@flatt_security) targeting Chroma in the AI Infrastructure category for a total of $20,000 and 2 Master of Pwn points

Thursday, October 8 - 4:15 PM

BunkyoWesterns (@BunkyoWesterns) targeting Samsung Galaxy S26 - Remote in the Mobile Phone category for a total of $50,000 and 5 Master of Pwn points

Thursday, October 8 - 4:45 PM

Hank Chen (@Hank0438) of InnoEdge Labs targeting Philips Hue Bridge Pro in the Smart Home category for a total of $40,000 and 4 Master of Pwn points

Thursday, October 8 - 5:30 PM

Cong Thanh (@ExLuck99), Duc Hieu (@gr4ss341) and Nam Dung (@greengrass19000) targeting Lexmark CX532adwe in the Printers category for a total of $20,000 and 2 Master of Pwn points

Thursday, October 8 - 6:30 PM

Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@yogehi) using Djini.ai from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs targeting Google Pixel 10 - Remote in the Mobile Phone category for a total of $300,000 and 30 Master of Pwn points

Thursday, October 8 - 7:00 PM

Chulhan Park, Mingeun Kim, SeokHun Lee, Inhyung Lee, Sehyun Baek, Nayeon Lee, Junseok Kim of Team MAMMOTH targeting Home Assistant Green in the Smart Home category for a total of $30,000 and 3 Master of Pwn points

Follow the action live! We'll be posting real-time updates and results throughout the competition on our blog and across social media. Stay up to date by following us on Twitter, Mastodon, LinkedIn, and Bluesky, and join the conversation using #Pwn2Own Ireland and #P2OIreland for continuing coverage.

A malicious HEIC image can become a route to remote code execution on a WordPress server. Researchers have demonstrated an attack chain that turns a normal Media Library upload into code execution in the PHP-FPM process that runs the site. The risk comes from libheif, a widely used component that reads HEIC, HEIF and AVIF […]

The post Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers appeared first on Cyber Security News.

Investigators in Timor-Leste have detained 16 people after raiding a building in Dili allegedly used to run telephone scams against people in Japan. The suspects are accused of posing as Japanese police, using staged surroundings and a prepared script to make their claims appear credible. The group included seven Japanese nationals and six Chinese nationals. […]

The post 16 Suspects Detained in Timor-Leste for Japanese Police Impersonation Scam appeared first on Cyber Security News.

Blockchain investigator ZachXBT says he infiltrated a Chinese crypto laundering network linked to North Korea’s Lazarus Group after the $1.5 billion Bybit hack. His investigation connected private chats with public blockchain records and, he says, helped freeze stolen funds while exposing operators who claimed to handle money from several major thefts. In an October 5 […]

The post Researcher Infiltrates Lazarus Group’s Crypto Laundering Network After $1.5B Bybit Hack appeared first on Cyber Security News.

An AI agent breached the Dutch Institute for Vulnerability Disclosure by chaining two previously unknown flaws in Zammad, an open source helpdesk platform. The September 21, 2026 attack moved from a hijacked session to root access, giving the intruder full control of the server within seconds. DIVD detected the intrusion the following day and blocked […]

The post Zammad Zero-Day Chain Lets AI Agent Hijack Sessions, Execute Code and Escalate to Root appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency has added a Citrix NetScaler vulnerability, tracked as CVE-2026-88779, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw affects Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). CVE-2026-88779 is an improper restriction of operations within the bounds of a memory […]

The post CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

Google’s Gemini Desktop app may soon introduce a “Full Access” permission that would let the AI assistant read files, control applications, access network services, and take action across a user’s Mac. The capability appears to be part of a hidden “Additional sandbox options” setting discovered in a recent version of the Gemini Desktop app. The […]

The post Google Gemini Will Soon Get Full Access Permission to Use Your Computer appeared first on Cyber Security News.

A new open-source command-line utility called RemoveMacAI lets Apple silicon Mac users running macOS 27 disable Apple Intelligence, remove downloaded on-device AI models, and prevent the operating system from automatically downloading them again. Developed by Om Lahore and released under the MIT license, RemoveMacAI addresses storage and manageability concerns for users who have disabled Apple […]

The post New RemoveMacAI Tool Removes Apple Intelligence Models and Reclaims Mac Storage appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apple has announced plans to strengthen macOS controls for Full Disk Access, citing concerns that increasingly autonomous AI agents could raise privacy and security risks by giving applications extensive access to users’ devices. In a developer update on October 2, Apple stated it will introduce additional controls for macOS Full Disk Access, a powerful permission […]

The post Apple Strengthens macOS Privacy Controls as AI Agents Become More Autonomous appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new ClickFix campaign is turning a web safety check into a route for malware. Visitors to compromised websites see a fake CAPTCHA or repair message and are told to open the Windows Run dialog, paste copied text, and press Enter. The instruction looks simple, but it makes the victim run the attacker’s command. The […]

The post ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache appeared first on Cyber Security News.

RemoveMacAI, an open-source tool on GitHub, lets Mac users disable Apple Intelligence, remove its downloaded models, and block future downloads. The utility can recover roughly 10GB to 12GB of storage, depending on which models are present. Its changes are reversible, and the removal process leaves macOS System Integrity Protection enabled. The tool addresses a storage […]

The post RemoveMacAI Free Up 12GB of Data by Removing Apple Intelligence Models appeared first on Cyber Security News.

Google is reportedly testing a new Gemini Desktop feature that could give its AI agent extensive control over a user’s Mac. This includes access to files, interaction with installed applications, and network communication, all with fewer prompts requiring user approval for each action. Currently, Google has not publicly released this capability, and it has not […]

The post Google Gemini to Gain Full Computer Access With New Permission appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes. The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and has since expanded across […]

The post GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware appeared first on Cyber Security News.

A critical heap-buffer-overflow vulnerability in libheif could allow authenticated WordPress users to achieve remote code execution by uploading a specially crafted HEIC image through the standard Media Library workflow. The issue, tracked as GHSA-x8r2-mggj-j6wr, affects the library’s uncompressed-image (unci) decoder and has been fixed in libheif 1.23.3. In affected WordPress deployments, uploaded HEIC files can […]

The post Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Apple plans to add stronger controls to Full Disk Access in macOS, warning that the powerful permission can expose a user’s most private data as AI agents become more capable. The company said the change will require users to take a far more deliberate action before granting an app this broad level of access. Full […]

The post Apple Tightens macOS Full Disk Access as AI Agents Become More Powerful appeared first on Cyber Security News.