Pwn2Own Berlin 2026 researchers win $1,298,250 for 47 flaws

Security researchers at the Pwn2Own Berlin 2026 hacking competition earned a total of $1,298,250 for successfully demonstrating 47 previously unknown vulnerabilities in widely used software and hardware. The event, which concluded on May 16 at the OffensiveCon conference, focused on enterprise technologies and artificial intelligence products.

The competition, organized by Trend Micro's Zero Day Initiative, saw participants target fully patched systems across categories including operating systems, virtualization platforms, and AI-assisted developer tools. The top-earning teams were Devcore and StarLabs SG, who collectively won nearly $750,000 of the total prize pool. Devcore earned $200,000 for a remote code execution exploit on Microsoft Exchange that granted SYSTEM-level privileges, $175,000 for a Microsoft Edge sandbox escape, and $100,000 for an exploit against Microsoft SharePoint. StarLabs SG won $200,000 for an exploit targeting VMware ESX.

AI products were a significant focus, with successful demonstrations against tools including OpenAI Codex, Cursor, LM Studio, and LiteLLM, earning researchers rewards ranging from $15,000 to $40,000. Other major targets included...