The Galaxy S26 Pwn2Own results are in, and they aren’t comforting: researchers broke into Samsung’s newest flagship several times during the first days of Pwn2Own Ireland 2026. No public patch or CVE exists yet, so the practical advice is simple. Keep your phone updated and watch for Samsung’s next security release.
Here are the facts that matter most, based on reports from BleepingComputer and Cybernews.
- Pwn2Own Ireland 2026 is run by Trend Micro’s Zero Day Initiative (ZDI).
- Reports say the Galaxy S26 was hacked at least twice on day one and three more times on day two.
- One chain reportedly ran code on the phone after a single email.
- Vendors get 90 days to patch before ZDI publishes the details.
- No CVEs or technical details have been published yet.
In short, the bugs are real, but you can’t be hit by a public exploit today.
What happened to the Galaxy S26 at Pwn2Own
Pwn2Own is a contest where researchers show working attacks on fully updated devices. Vendors then get time to fix the bugs. Think of it as a controlled break-in, not a leak.
According to BleepingComputer, three teams hit the S26 on day one: Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security. The site said some bugs used were already known to the vendor. The day closed with 32 zero-days and $388,500 in payouts.
Day two added more. BleepingComputer’s day-two report says three more teams broke the phone, including KAIST’s Kyeongmin Kim, PetoWorks, and CENSUS Labs. Day two alone totaled 45 zero-days and $232,500.
One detail is easy to miss. Reports say some bugs in the S26 chains were already known to Samsung, but the rest were new. A “zero-day” is a flaw the vendor had no fix for when it was shown, so each new one means a fix still has to be written, tested, and pushed to millions of phones.
That last step is the slow one. Samsung ships patches monthly, and carrier-locked phones often get them a few weeks later than unlocked ones. If you bought your S26 through a carrier, expect to wait a bit longer than a friend with an unlocked model.
Counts differ a little between reports, so treat the exact number of S26 breaks as approximate.
Galaxy S26 Pwn2Own: the one-email attack explained
Cybernews reports that Japan’s Ikotas Labs ran code on a Galaxy S26 by sending one email. The chain used four vulnerabilities, and Samsung already knew about only one of them. The team earned $11,000 for the S26 run.
The word “email” sounds scarier than it may be. Details are not public, so we don’t know whether you’d need to open the message or whether just receiving it is enough. Until ZDI publishes more, don’t assume either way.
Who tried what: a quick scoreboard
This table lists the teams named in the reports, so you can see how many separate groups found a way in.
| Team | Day | Reported detail |
|---|---|---|
| Ikotas Labs | One | Code execution via one email, four bugs, $11,000 |
| Interrupt Labs | One | Successful S26 chain, method not published |
| Nguyen Thanh Dat (Viettel) | One | Successful S26 chain, method not published |
| Kim, PetoWorks, CENSUS Labs | Two | Three more S26 hacks reported |
Many independent teams finding ways in suggests a broad attack surface, not one freak bug. That said, flagship phones from every brand get broken at this event.
When will a Galaxy S26 patch arrive?
Pwn2Own rules give vendors 90 days to fix the bugs before ZDI discloses them. That puts a likely deadline around early January 2027, though Samsung can ship fixes sooner.
Samsung hasn’t commented in the reports we found. Fixes would most likely land in a monthly patch. If you want to know what’s already rolling out, our guide to Samsung’s October 2026 security update covers the current release.
Pixel owners aren’t off the hook either. Our piece on the Pixel 11 security patch gap shows how patch timing can differ between phones.
How to protect your Galaxy S26 right now
None of these steps is a cure, but together they shrink your risk while patches are pending.
- Open Settings > Software update and install anything pending today.
- Turn on automatic updates so you don’t miss the next patch.
- Don’t open attachments or links in emails from people you don’t know.
- Remove apps you no longer use, since each one adds attack surface.
These habits matter more than any single patch, because attackers usually need you to do something first.
Frequently Asked Questions
Is my Galaxy S26 hacked right now?
No evidence says so. These were contest demos by researchers, and the details haven’t been published.
Can a hacker really take over my phone with one email?
Cybernews reports a team did it in the contest using four chained bugs. Real-world attacks need working exploit code, which isn’t public yet.
Did the iPhone 17 get hacked too?
Not in the day-two report. BleepingComputer says no contestant registered an iPhone 17 attempt, despite a $300,000 top prize.
What is Pwn2Own?
It’s a hacking contest run by Trend Micro’s Zero Day Initiative. Researchers get cash for showing new bugs, and vendors get time to fix them.
Our take: don’t panic, but don’t ignore the next Samsung patch either. Several teams breaking a brand-new flagship is a signal to update promptly, and to treat unexpected email on your phone with extra suspicion until details come out.
Leave a Reply