CuraSec

tag: Pwn2own · 3 items

Learn archived Three Teams Remotely Exploit Fully Patched Pixel 10 at Pwn2Own Ireland
2026-10-09 · The Hacker News · source ↗ #pwn2own#mobile-exploit#google-pixel
  • Engineer — Learn: Remote code execution on a fully patched Pixel 10 is noteworthy research, but no patch or public PoC is available yet and mobile handsets are outside the typical cloud/AppSec engineering stack; monitor Google’s security bulletins for patches once they drop.
  • SOC/IR — Learn: Contest rules channel these exploits to the vendor privately, so there are no IOCs, public TTPs, or active exploitation signals to hunt; file as background awareness of Pixel attack surface until Google publishes details.
  • Leader — Learn: A controlled competition result with no active exploitation; if the org manages a corporate Pixel fleet, note that remote compromise of fully patched devices is now demonstrated and watch for Google’s patch announcement to assess MDM policy response.
Learn archived Pwn2Own Ireland 2026: $1.26M paid for 98 zero-days
2026-10-09 · BleepingComputer · source ↗ #zero-day#vulnerability-research#pwn2own
  • Engineer — Learn: Contest zero-days are under responsible-disclosure embargo until vendors patch; monitor vendor advisories over the coming weeks for products you run, especially edge devices and browsers commonly targeted at Pwn2Own.
  • SOC/IR — Skip
  • Leader — Learn: Useful data point for board-level discussions on software attack surface breadth; no specific vendor or product is named in available reporting, so no vendor-risk action is warranted yet.
Learn archived Samsung Galaxy S26 hacked three times more at Pwn2Own Ireland
2026-10-08 · BleepingComputer · source ↗ #zero-day#mobile-security#pwn2own
  • Engineer — Learn: Pwn2Own findings highlight zero-day surface on Android/Samsung devices, but no CVEs, patches, or PoCs are public yet; monitor Samsung’s coordinated disclosure process for any vulnerabilities affecting enterprise mobile deployments.
  • SOC/IR — Skip
  • Leader — Skip