GoKawiil
Tech News
A researcher reverse-engineered Meta's AI companion app to intercept the over-the-air firmware update process for Meta Ray-Ban smartglasses, extracting a CDN download URL for the firmware. Using this access, they achieved arbitrary code execution on the device and reported the vulnerability to Meta through its bug bounty program, eventually agreeing on a payout after negotiation.
Security researcher Orange Tsai of DEVCORE publicly detailed a Microsoft Edge sandbox-escape exploit chain built entirely from five logic bugs and two Windows features, with no memory corruption or AI assistance involved. The chain earned him $175,000 and 17.5 Master of Pwn points at Pwn2Own Berlin 2026, and he has since presented the full methodology at HITCON and Hexacon.
Trend Micro's Zero Day Initiative concluded Pwn2Own Ireland 2026, awarding $1,262,000 across three days as researchers demonstrated 98 zero-day vulnerabilities in devices including the Samsung Galaxy S26, Google Pixel 10, OpenAI Codex and Oracle's Autonomous AI Database. Ikotas Labs won the contest overall with $361,000 and 42.5 Master of Pwn points, including a $300,000 payout for a chained exploit against the Pixel 10, ahead of runners-up Xint and Team ZyGoat.
During the second day of Pwn2Own Ireland 2026, security researchers successfully exploited the Samsung Galaxy S26 three times, with multiple teams including KAIST Hacking Lab and others demonstrating zero-day vulnerabilities. The event awarded a total of $232,500 for various exploits across different devices and categories.
On the opening day of Pwn2Own Ireland 2026, security researchers chained 32 zero-day vulnerabilities to breach devices across categories including mobile phones, printers, smart home gadgets and AI systems, earning $388,500 in prizes. Samsung's Galaxy S26 was compromised twice, while VinSOC researchers led the leaderboard after chaining seven zero-days against a Philips Hue Bridge Pro and five against Oracle's Autonomous AI Database. Other targets included OpenAI's Codex coding agent, Lexmark and Canon printers, a Sonos Era 300 speaker, and LiteLLM, though an attempt on the Google Pixel 10 failed within the time limit.