Hackers Break Into Popular Phones and Smart Home Gadgets at Cork Competition
Some of the world’s top security researchers spent last week in Cork breaking into fully updated phones, speakers, printers and smart home hubs. The flaws they found are now being fixed, and Cork Safety Alerts is urging readers to keep their devices updated.
The annual Pwn2Own Ireland hacking competition got under way in Cork on 6 October, organised by Trend Micro’s Zero Day Initiative. It’s the third year the event has been held in the city, after it moved from Toronto in 2024.
The idea is simple: researchers are paid to find and demonstrate serious security flaws, known as “zero-days”, in products that have every available update installed. The flaws are then handed to the manufacturers so they can be fixed before criminals discover them.
According to results published by the organisers, this year’s contest was the biggest yet in Cork. Over three days, researchers were paid $1,262,000 for 98 previously unknown vulnerabilities, from 61 completed attempts by 29 teams. Last year’s event uncovered 73 flaws worth $1,024,750.
Everyday devices targeted
Many of the products tested are found in Irish homes. Samsung’s flagship Galaxy S26 phone was successfully hacked repeatedly across all three days, while Google’s Pixel 10 was compromised three times on the last day.
Smart home equipment fared little better. The organisers reported that one team linked seven separate flaws to take control of a Philips Hue Bridge Pro lighting hub, and that a researcher broke into a Sonos Era 300 speaker in less than a minute. Printers from Lexmark, Canon and Brother were also successfully attacked, along with the Home Assistant Green smart home controller.
This year’s competition also introduced a new category for wellness and healthcare devices, alongside AI tools and messaging apps.
The overall winners, Ikotas Labs, took home $361,000, including the contest’s largest single prize of $300,000 for chaining several flaws together to hack the Pixel 10.
Known flaws left unfixed
One finding stands out for ordinary users. The competition results show that several successful attacks relied partly on weaknesses manufacturers already knew about. In one case, a Galaxy S26 attack used a bug the manufacturer was aware of but had not yet patched.
That’s a reminder that updates only protect you once they’re released and installed.
What happens next
Under the competition rules, manufacturers have 90 days to fix the flaws before the organisers publish the details. That means security updates for many of these products are likely to arrive over the coming weeks and months.
Cork Safety Alerts is advising readers to turn on automatic updates for phones, tablets, smart speakers, lighting hubs and printers, and to install updates promptly when prompted. Devices that no longer receive updates from their manufacturer should be considered for replacement, as any flaws found in them may never be fixed.
The competition coincides with European Cybersecurity Month, the EU’s annual awareness campaign that runs throughout October.