TrendAI Zero Day Initiative awards over $1,2m at Pwn2Own - IT

TrendAI has celebrated the efforts of the global security research community at Pwn2Own Ireland by awarding a total of $1 262 000 in prizes.

Contestants discovered and disclosed 98 unique zero-day vulnerabilities across categories including: mobile phones; smart devices; wellness; printers; messaging; AI infrastructure; and AI coding agents.

Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, says: “The vulnerabilities discovered at Pwn2Own are sent to vendors so they can patch them quickly. Having visibility into these vulnerabilities also helps protect TrendAI customers via virtual patching. The lasting value of an event like this is what defenders learn.

“Every exploit chain demonstrated on stage teaches us something new how modern systems break, and those lessons go directly into how we train our own research capability to discover, validate and remediate the one faster. As AI tools and infrastructure continue to become central to business functions, staying ahead of vulnerabilities will be as critical as ever.”

The devices on stage at Pwn2Own are deliberately familiar – phones, printers, smart hubs, wearables – and that familiarity is the point. Watching a researcher chain several flaws together to take over a consumer phone makes visible a process that usually happens out of sight. It is the same process, and often the same class of flaw, that applies to the enterprise-grade systems behind global ecommerce, banking, critical infrastructure and healthcare.

The disclosures made through TrendAI ZDI at Pwn2Own and year-round allow vendors to quickly understand and fix vulnerabilities before cybercriminals exploit them, ultimately benefiting organizations and end users of the impacted software or hardware.

TrendAI research has shown that vendors are increasingly neglecting to patch software vulnerabilities that are disclosed to them. Through the TrendAI ZDI coordinated disclosure process, TrendAI Vision One customers are protected an average of 115 days ahead of the rest of the industry.

Highlights from the event included:

Ikotas Labs earned the title, Master of Pwn and $300 000, after it chained multiple issues together to successfully exploit the Google Pixel 10 at the very end of the three-day competition. Ikotas Labs is the first-ever Japanese team to claim the Master of Pwn title.

Xint, which placed second in the competition, earned $150 000 by successfully demonstrating a remote exploit of the Google Pixel 10 through a single bug collision.

Interrupt Labs earned $5 000 after it successfully took over the Lexmark CX532adwe printer and played DOOM on its screen.