## Pwn2Own Berlin 2026: Day 1 Highlights The **Pwn2Own Berlin 2026** competition kicked off with a flurry of activity, as security researchers demonstrated their skills by exploiting a wide range of software and hardware targets. The event, which focuses on enterprise technologies and artificial intelligence, takes place at the OffensiveCon conference from May 14 to May 16. ## Edge Sandbox Escape Earns Top Prize **Orange Tsai** stood out by earning $175,000 for chaining four logic bugs to achieve a sandbox escape on **Microsoft Edge**. This impressive feat highlights the complexity and potential impact of chained vulnerabilities. > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlslrhjrvc2s">View on BlueSky</a> ## Windows 11 Under Fire **Windows 11** was successfully targeted three times by different teams: * **Angelboy** and **TwinkleStar03** (working with the **DEVCORE** Internship Program) * **Marcin Wiązowski** * **Kentaro Kawane** of **GMO Cybersecurity** Each team earned $30,000 for demonstrating new privilege escalation zero-days on the operating system. > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlsterlyhk2d">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlsyezpkyc2m">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mltgpmo7ac2p">View on BlueSky</a> ## Linux and Container Exploits **Valentina Palmiotti** (chompie) of **IBM X-Force Offensive Research (XOR)** had a successful day, collecting $20,000 for rooting **Red Hat Linux for Workstations** and an additional $50,000 for a zero-day in the **NVIDIA Container Toolkit**. > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mltebpvjlc2p">View on BlueSky</a> > <a href="http://bsky.app/profile/thezdi.bsky.social/post/3mlsm3vbvks2s">View on BlueSky</a> ## AI/ML Platform Vulnerabilities Uncovered Several vulnerabilities were found in AI and machine learning platforms, including: * **k3vg3n**: Took down **LiteLLM** ($40,000) by chaining 3 bugs. * **Satoki Tsuji** and **haehae**: Exploited **NVIDIA Megatron Bridge** zero-days ($20,000). * **Compass Security** and **maitai** of **Doyensec**: Hacked **OpenAI's Codex** coding agent (each earning $40,000). * **haehae**: Dropped a **Chroma** zero-day ($20,000). * **STARLabs SG**: Found a **LM Studio** zero-day ($40,000). > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlso3j67ns2s">View on BlueSky</a> > <a href="http://bsky.app/profile/thezdi.bsky.social/post/3mlsottlmak2s">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mltcik6cvs2w">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlst4byglc2d">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlswuldquc2m">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mlt5kuba622z">View on BlueSky</a> > <a href="https://bsky.app/profile/thezdi.bsky.social/post/3mltheam2ps2p">View on BlueSky</a> ## Leaderboard Currently, the **DEVCORE Research Team** is leading the competition with $205,000, followed by **Valentina Palmiotti** with $70,000. ## Day Two Targets On the second day, competitors will target zero-days in **Microsoft SharePoint**, **Microsoft Exchange**, **Windows 11**, **Apple Safari**, **Cursor**, **Red Hat Enterprise Linux for Workstations**, **LM Studio**, **OpenAI Codex**, **LiteLLM**, **Anthropic Claude Code**, and **Mozilla Firefox**. ## Pwn2Own Rules and Impact Researchers targeting fully patched products in various categories can earn over $1,000,000 in cash and prizes. All targeted devices run the latest operating system versions, and entries must compromise the target and demonstrate arbitrary code execution. Vendors have 90 days to release security fixes after the flaws are disclosed. Last year, **TrendMicro's Zero Day Initiative** awarded $1,078,750 for 29 zero-day vulnerabilities.  ## The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold. This guide covers the 6 surfaces you actually need to validate. [Download Now](https://hubs.li/Q048zztN0)