On the first day of the Pwn2Own Ireland 2025 competition , participating security researchers uncovered 34 unique zero-day vulnerabilities and collected a total of $522,500 in prize money.
The most impressive performance came from Bongeun Koo and Evangelos Daravigkas of Team DDOS, who exploited eight different vulnerabilities to compromise a QNAP Qhora-322 Ethernet wireless router via its WAN interface. They were then able to attack a QNAP TS-453E. Their success earned them $100,000 and led to them taking second place on the “Master of Pwn” leaderboard, with 8 points.
Meanwhile, teams like Synacktiv, Summoning Team (Sina Kheirkhah), DEVCORE , and Stephen Fewer of Rapid7 managed to gain root access to systems like Synology BeeStation Plus, Synology DiskStation DS925+, QNAP TS-453E , and Home Assistant Green, with each team collecting $40,000 respectively.
Additionally, researchers from STARLabs, Team PetoWorks, Team ANHTUD , and Ierae exploited the Canon imageCLASS MF654Cdw, while STARLabs won an additional $50,000 for exploiting a Sonos Era 300. Team ANHTUD also exploited a vulnerability in the Phillips Hue Bridge, securing a $40,000.
See also: LANSCOPE Endpoint Manager vulnerability allows remote code execution
Finally, Summoning Team (Sina Kheirkhah & McCaulay Hudson) combined two zero-day vulnerabilities to gain root access to a Synology ActiveProtect Appliance DP320 , earning $50,000 . Summoning Team’s total first-day earnings were $102,500 , and after accumulating 11.5 points , they took first place on the Master of Pwn leaderboard
The idea behind Pwn2Own and the disclosure process
The competition is organized by the Zero Day Initiative (ZDI) and aims to identify vulnerabilities before they are exploited by malicious actors. ZDI coordinates “responsible disclosure” with the respective vendors.
After a vulnerability is disclosed in the competition, vendors have 90 days to release security fixes; if they fail to do so, ZDI makes the relevant information public, increasing the risk of exploitation of vulnerable products.
The Pwn2Own organization also functions as a "security lab": it uses the competition to focus research on devices and protocols considered critical to the world of technology and consumers.
Categories, new attacks and targets
This year's Pwn2Own Ireland competition includes eight target categories, with a focus on smartphones (Apple iPhone 16, Samsung Galaxy S25, Google Pixel 9), messaging apps, smart home devices, printers, home network equipment, network storage systems, surveillance devices and wearable technologies (such as Meta's Ray-Ban smart glasses and Quest 3/3S headsets).
See also: Critical flaw in more than 73,000 WatchGuard Firebox devices
A major innovation this year is the expansion to mobile phone USB ports: participants can attempt to hack locked phones via a physical connection. At the same time, traditional protocols such as Wi-Fi, Bluetooth and NFC remain valid attack vectors.
Today (day two), researchers are again testing devices in the categories of network storage, printers, smart homes, and surveillance systems, as well as the Samsung Galaxy S25 in the mobile category.
$1 million prize
ZDI announced that it will offer a $1 million prize to researchers who present a zero-click exploit in WhatsApp (i.e. code execution without user interaction).
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Meta, QNAP, and Synology co-sponsor the competition, which takes place from October 21 to 24, 2025 in Cork City, Ireland.
At last year's Pwn2Own Ireland event, researchers received a total of $1,078,750 for over 70 zero-day vulnerabilities. The Viettel Cyber Security earned $205,000, thanks to vulnerabilities it discovered in QNAP, Sonos, and Lexmark devices.
In January 2026, ZDI will return to the Automotive World technology show in Tokyo for the third Pwn2Own Automotive competition , with Tesla again participating as a sponsor.
See also: ZYXEL vulnerability allows bypass of authorization checks
Prospects and challenges — What to expect
Day 1 of Pwn2Own Ireland 2025 highlighted the top security researchers: the specialized teams that managed to discover and exploit vulnerabilities in multiple products are emerging as pioneers in the field of cybersecurity.
The addition of USB as a mobile attack vector opens up new areas of research — especially since smartphones are also considered among the most secure devices. The ability to attack without any user interaction (zero-click) in WhatsApp adds a high-risk (and high-reward) element to this year’s event.
The 90-day policy for releasing updates from vendors sets a security time limit, forcing companies to react quickly — but it also opens up the debate about how quickly they can respond to complex scenarios.
Finally, the competition between researchers for the title of Master of Pwn increases the intensity of the competition: it is not only about monetary gains, but also about recognition, influence and prestige in the security community.
Overall, Pwn2Own Ireland 2025 brings a dynamic mix of technical challenges, strategic moves, and competitive spirit — and is a reflection of where the global cybersecurity community.
Source: www.bleepingcomputer.com
