The Samsung Galaxy S26 was hacked multiple times at Pwn2Own Ireland 2026 this week, with one team of ethical hackers remotely taking control of a fully patched phone using nothing more than a single email. The Galaxy S26 hacked demonstrations took place at the contest in Cork, Ireland, where security researchers are paid to find serious flaws before criminals can exploit them.
The headline attack came from Ikotas Labs, a Japanese security company, on the first day of the event. Its researchers chained together four vulnerabilities, three of them previously unknown to Samsung, to run their own code on the Galaxy S26 remotely. The attack needed only one email to trigger, earning the team an $11,000 bounty and global attention. Two more teams, Interrupt Labs and Viettel Cyber Security’s Nguyen Thanh Dat, also compromised the S26 on day one, though some of the flaws they used were already known to the vendor.
The phone fared no better on day two. Three more teams, KAIST Hacking Lab’s Kyeongmin Kim, PetoWorks, and the pairing of Dimitrios Valsamaras and Ken Gannon from the Mobile Hacking Lab, each broke into the S26. Across both days, researchers demonstrated attacks involving five apparently new flaws in Samsung’s flagship.
What the Galaxy S26 hacked results actually mean
Sensational as it sounds, the results need context. Pwn2Own, organised by Trend Micro’s Zero Day Initiative, is an ethical hacking contest. Every device attacked is fully patched, and the goal is to find flaws in a controlled setting so vendors can fix them. None of these attacks are being used against real owners in the wild, and Samsung now has 90 days to issue patches before the details are disclosed publicly.
The contest’s rules also make the bar extraordinarily high. Researchers get just a few minutes and limited attempts to demonstrate a working attack on the latest firmware. The fact that teams succeeded anyway shows the value of the exercise, but it does not mean your Galaxy S26 can be broken into by a stray email tomorrow. The Ikotas attack used four chained vulnerabilities working together, and the specifics remain secret while Samsung works on fixes.
It is also worth noting how the S26 compared with its rivals at the same event. Google’s Pixel 10 also fell to attackers, with Ikotas winning the contest’s biggest prize, $300,000, for compromising it on the final day and finishing as the event’s top-ranked team. Apple’s iPhone 17 was listed as a potential target with a $300,000 award for a remote hack, but no contestant even registered an attempt.
What UK Galaxy owners should do
The most important takeaway for the millions of people who own Samsung phones is a familiar one, but it matters more this week than most:
- Install software updates promptly when Samsung releases them. The fixes for these flaws will arrive through normal security updates, and Samsung’s recent track record on monthly patches has been solid.
- Be cautious with emails and messages from unknown senders. One of the winning attacks needed only a single email to get started.
- Keep your phone’s automatic update feature switched on so patches install without delay.
- Do not worry about the technical details yet. Samsung has 90 days of quiet time to fix the issues, which is standard practice for this kind of responsible disclosure.
Samsung has not yet commented publicly on the specific findings, but it will be expected to address them in upcoming monthly security releases. The company has consistently used Pwn2Own results to strengthen its phones in previous years.
A good week for security, despite the headlines
Strange as it sounds, a week in which flagship phones get hacked is good news for consumers. The whole point of Pwn2Own is to surface flaws under white-hat conditions rather than letting criminals discover them first. Between day one and day two, researchers earned $388,500 and $232,500 respectively for 77 zero-day exploits across phones, smart home devices, printers, AI infrastructure and a new wellness device category, and every one of those bugs is now on a vendor’s fix list.
The Galaxy S26 remains one of the most security-conscious Android phones on the market, with Samsung’s monthly update programme delivering patches to UK owners regularly. For background on how those updates work, see our report on Samsung’s October 2026 security update rollout. The lesson of Cork is not that the phone is unsafe, but that even the best defended devices need constant vigilance, and that this week, the good guys got there first.
