Pwn2Own Ireland teams logged 32 zero-days and over $368,000 in prizes on October 6, breaking LiteLLM, OpenAI Codex and Oracle's AI database. Vendors now have 90 days to ship fixes before the Zero Day Initiative publishes the details.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence62
Pwn2Own Ireland 2026 researchers exploited 32 zero-days on day one for $388,500, including LiteLLM flaws and an OpenAI Codex argument injection. Vendors now have 90 days to ship fixes before ZDI publishes details, and the report describes contest exploits only.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence55
ZDI's Pwn2Own Ireland 2026 schedule sets 21 exploit attempts in Cork on October 6, the largest a $300,000 remote Pixel 10 entry. The schedule names exact models and time slots, so operators of the targeted products know which results to look for on ZDI's live leaderboard.
Publishers:thezdi.com
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+5
- Incentives40
- Confidence65
build1 publisherOne report An operator found a hidden dropper reinstalling itself every 20 minutes on his Synology NAS only because he asked why an unexplained scheduled task existed. The vendor scan reported nothing.
Reality
- Evidence52
- Adoption12
- Hype gap+14
- Incentives34
- Confidence44
NIST stopped enriching every CVE, HackerOne paused the Internet Bug Bounty, Pwn2Own turned entrants away, and Cisco began bundling flaws under one ID. Attackers barely changed method.
Publishers:beazley.security
Reality
- Evidence38
- Adoption55
- Hype gap+14
- Incentives72
- Confidence44