Pwn2Own Berlin 2026 just wrapped up two days of heavy-hitting exploits, with nearly $1 million paid out for 39 zero-day vulnerabilities. This matters because despite years of patches, Windows 11 and Microsoft Exchange remain prime targets, exposing ongoing security weaknesses.
- Windows 11 hacked three times on Day 1, each earning $30,000
- Orange Tsai’s Edge sandbox escape nets $175,000
- Microsoft Exchange compromised for $200,000 on Day 2
- Multiple AI platforms also breached, including OpenAI Codex
Flagship Power, Mid-range Compromises: Windows 11’s Uneasy Security
Windows 11 suffered three separate privilege escalation zero-days on Day 1. Each exploit earned a neat $30,000—modest compared to the $175,000 Orange Tsai scored escaping Edge’s sandbox using a chain of four logic bugs. On paper, hacking Windows 11 this easily should be a wake-up call. But the catch is simple: Microsoft’s attack surface remains vast, and patch cycles lag behind active exploit demonstrations.
Exchange’s $200,000 Hole: The Crown Jewel for Attackers
Day 2’s headline exploit was a fully patched Microsoft Exchange Server falling to a remote code execution chain. Orange Tsai again showed his skill, chaining three bugs to gain SYSTEM privileges and walk away with the biggest single payout so far—$200,000. What this actually means is that critical enterprise infrastructure is still vulnerable, even under the latest updates. Don’t hold your breath for all-day security until these flaws are patched—90 days to fix is generous, but real-world exploitation windows remain.
AI Platforms: The New Frontier of Zero-Days
AI systems aren’t immune to these attacks. Early reports confirmed zero-days on LiteLLM, OpenAI Codex, NVIDIA Megatron Bridge, and others. The AI category is heating up, proving that machine learning models and their deployment pipelines come with fresh, exploitable risks. This trend will only grow as AI adoption expands, forcing vendors to rethink security beyond traditional software.
Overflowing Interest: The Event Hits a Breaking Point
For the first time in its 19-year run, Pwn2Own Berlin hit capacity, turning away over 150 researchers. Some have publicly dropped zero-days rather than wait for next year. This flood of talent and vulnerabilities highlights the widening gap between security researchers and vendor patch cycles. It also pressures companies to accelerate fixes or face public exploit releases.
GizmoIndo’s Take
Pwn2Own Berlin 2026 reveals an uncomfortable truth: even flagship platforms like Windows 11 and Microsoft Exchange are riddled with fresh holes. The high payouts aren’t just a reward—they’re a warning. Vendors tout patches and improved security, but attackers continue to find new vectors faster than fixes roll out. Meanwhile, the rise of AI platform exploits signals a shifting battlefield that will complicate security strategies for years. For users and enterprises, the takeaway is clear: vigilance and layered defenses remain essential, because no software is truly safe—even when it claims to be.
(Via)
