BunkyoWesterns closed out the Galaxy S26 results at Pwn2Own Ireland 2026 with a remote chain of two bugs on October 8: one collision and one unique bug. The entry earned $8,250 and 3.75 Master of Pwn points, according to the Zero Day Initiative’s (ZDI) final-day results.
Seven successful entries across three days
ZDI recorded seven successful Galaxy S26 entries in its daily results: three on October 6, three on October 7 and one on October 8. They were contest demonstrations, not reported attacks on ordinary users.
The first day’s entries came from Viettel Cyber Security, Interrupt Labs and Ikotas Labs. Each chain used four bugs. ZDI classified three bugs in the Viettel entry as vendor-known; Interrupt Labs used three collisions and one zero-day; and Ikotas Labs used one bug that was known to Samsung and still unpatched at the time of the result. The October 6 results list the three entries.
On October 7, a joint team demonstrated a one-bug Confused Deputy chain. Kyeongmin Kim’s remote entry used three bugs—one unique and two collisions—while PetoWorks remotely accessed the phone using three collision bugs, according to the second-day results. BunkyoWesterns’ two-bug chain was the final Galaxy S26 entry in the October 8 results.
What a collision means
In these results, a collision marks an entry that used at least one bug already known to the vendor or previously shown. Counting the individual entries, six of the seven Galaxy S26 chains included a collision.
That label describes a bug’s contest status; it does not mean the bug had been patched. Ikotas Labs’ entry makes the distinction concrete: ZDI said one of its four bugs was known to Samsung but remained unpatched at the time of the October 6 result.
What the tally says about security
Seven successful entries make for a striking contest tally, but the count is not a standardized measure of a phone’s overall security. It records successful demonstrations under contest conditions, shaped by the entries researchers made and the contest rules. It cannot rank the Galaxy S26 against the Google Pixel 10 or establish how often ordinary owners face attacks.
For Galaxy S26 owners, the useful distinction is simple: the results show researchers succeeded in contest demonstrations. The number of entries is a contest result, not a handset risk score.
