Security researchers claimed nearly $386,000 in prize money on day two of Pwn2Own Berlin 2026 after discovering 15 previously unknown vulnerabilities across Windows 11, Red Hat Enterprise Linux, and other major platforms.
The second day of the annual hacking competition saw competitors successfully exploit critical zero-day flaws in enterprise and consumer software, demonstrating significant security gaps in widely-used systems.
The $385,750 in bounties reflects the severity and exploitability of the vulnerabilities discovered. Pwn2Own Berlin serves as a controlled environment where ethical hackers demonstrate security flaws to vendors before public disclosure, allowing companies time to develop and release patches.
Windows 11 and Red Hat Enterprise Linux dominated the vulnerability disclosures, two of the most critical operating systems in use across consumer, corporate, and government environments. The breadth of affected platforms underscores the ongoing challenge of securing complex software ecosystems.
Pwn2Own competitions typically attract top security researchers worldwide who compete for substantial cash prizes and recognition. The event structure incentivizes responsible disclosure—researchers report vulnerabilities to organizers and vendors rather than exploiting them maliciously.
Vulnerabilities discovered at Pwn2Own are reported to affected vendors through a coordinated disclosure process. Companies receive details of the flaws and are given time to develop patches before information becomes public, typically at security conferences or through vendor advisories.
The competition highlights the value security researchers place on finding zero-days and the financial incentive structures that support responsible vulnerability research. By offering significant bounties, events like Pwn2Own redirect potential exploit development away from black markets and toward legitimate security improvement.
Full results from Pwn2Own Berlin 2026 will likely provide detailed technical information about the discovered vulnerabilities, vendor responses, and potential patches. Security teams should monitor official channels from Microsoft and Red Hat for updates addressing flaws uncovered during the competition.
Anthropic has signed out some Claude users and removed saved payment methods after infostealer malware on their computers hijacked active sessions to drain API usage credits. The company is issuing refunds for unauthorized charges.
Former NYC Traffic Commissioner Sam Schwartz warns that autonomous vehicle expansion creates significant cybersecurity risks, including the potential for bad actors to seize control of connected cars and weaponize them.
More than a decade of Steam files, including beta builds and finished games from Valve and third-party developers, have been exposed in a major data leak totaling over 12 terabytes.
A new vulnerability called Omarchy allows any user-level process to gain root privileges through privilege escalation. The flaw has sparked significant discussion in security circles.