Pwn2Own 2026: Hackers Just Broke the Hue Bridge, Sonos and Home Assistant — What to Do About It

Here’s the headline, straight: at a hacking contest in Cork, Ireland last week, researchers broke into three devices sitting in millions of smart homes right now — the Philips Hue Bridge Pro, the Sonos Era 300 smart speaker, and the Home Assistant Green hub. Real exploits, real zero-day vulnerabilities, real money paid out.

Here’s the part most coverage buries: that’s the contest working exactly as designed. Nobody’s light bulbs are being hacked tonight. The researchers handed everything to the vendors under responsible disclosure, patches are on a 90-day clock, and there’s no report of any of these flaws being exploited in the wild. What this week’s haul actually tells you is something more useful — where the weak spots in a typical smart home are, and exactly what to do about them before patches land.

This is that to-do list. No panic, no hype — just what happened, what it means for each device you own, and a hardening checklist you can finish in about ten minutes.

Key Takeaways

• Pwn2Own Ireland 2026 (October 6–8, Cork) ended with 98 zero-day vulnerabilities and $1,262,000 in payouts — including successful hacks of the Philips Hue Bridge Pro (7 zero-days, $40,000), the Sonos Era 300 ($50,000), and the Home Assistant Green (~$30,000).
• This was a controlled contest, not real-world attacks. Researchers disclosed everything to vendors through the Zero Day Initiative, which gives vendors 90 days to ship patches before details go public. No in-the-wild exploitation has been reported.
• If you own any of these three devices, your move is simple: turn on automatic updates, update the companion app, and run the 10-minute hardening checklist below. You don’t need to replace anything.
• The bigger lesson isn’t about these three products. Every product on the contest schedule was hacked at least once — the attack surface that matters is your whole home network, and the defenses that matter are updates, strong passwords, and a router you actually maintain.

No affiliate links on this page — nothing here earns us a commission. This one’s about keeping your smart home safe, not selling you gear.

What actually happened in Cork

Pwn2Own is the security industry’s flagship hacking contest, run by Trend Micro’s Zero Day Initiative (ZDI). The Ireland edition brings dozens of research teams together for three days. They pick targets from a published schedule — phones, smart home gear, printers, AI infrastructure — and get paid for demonstrating working exploits against devices running the latest firmware. Find a real flaw, chain it into code execution on stage, walk away with cash and “Master of Pwn” points.

The 2026 edition ran October 6–8 in Cork with 29 research teams, and the final tally (reported October 9) was 98 unique zero-day vulnerabilities for $1,262,000 in awards. Day one alone produced 32 zero-days and more than $368,000 in payouts; day two added $232,500 for 45 unique flaws. The overall winner was the Ikotas Labs team, which collected $361,000 and the Master of Pwn title. Every product on the schedule was exploited at least once — including, notably, the Pixel 10 (three separate hacks, $562,500 combined) and the Galaxy S26 (hacked in all seven attempts).

Three of the successful targets live in smart homes specifically, and those are the ones that matter to AbodeAlly readers:

Device	Who hacked it	What they used	Bounty
Philips Hue Bridge Pro	Vũ Chí Thành and Huỳnh Đức Tin (VinSOC)	Seven zero-day vulnerabilities	$40,000
Sonos Era 300	_McCaulay	Out-of-bounds write + format string bug	$50,000
Home Assistant Green	Multiple teams (day two)	Not publicly detailed yet	~$30,000

The three smart-home hacks, one by one

Philips Hue Bridge Pro: seven zero-days for $40,000

This was the smart-home headline of the week. Two VinSOC researchers — Vũ Chí Thành and Huỳnh Đức Tin — found seven distinct zero-day vulnerabilities in the Philips Hue Bridge Pro, the hub at the center of millions of Hue lighting setups. Their exploit earned a $40,000 bounty, one of the largest smart-home payouts of the contest.

Why the Bridge Pro matters so much: it’s not a bulb, it’s the brain. It sits on your home network with a permanent connection, manages every bulb and accessory in the house, and — in a worst-case scenario — a compromised bridge is a foothold inside your network, not just a flickering light. Security researchers have long considered smart hubs the juiciest target in a smart home for exactly this reason: one device, total control, always on.

If you own one: this is a patch-waiting game, and your job is to make sure the patch reaches you. Open the Hue app, go to Settings > Software update, and confirm automatic updates are on. The 90-day responsible-disclosure clock means Signify (Philips Hue’s parent company) has until roughly early January 2027 to ship fixes before ZDI publishes details — but vendors routinely ship sooner for contest findings this prominent. The one thing you must not do is ignore the app for three months. If you’re running a Hue setup and wondering whether the bridge is worth the complexity at all, our guide to whether you still need a hub for smart devices walks through the trade-offs.

Sonos Era 300: memory-corruption bugs for $50,000

Researcher _McCaulay earned $50,000 — the single biggest smart-home bounty of the event — by chaining an out-of-bounds write with a format string bug against the Sonos Era 300. Both are classic memory-corruption flaws, the kind of low-level bugs that let an attacker push past a device’s intended behavior and run their own code.

A smart speaker is an unusual hack target in one respect and an obvious one in another. It’s a computer with a microphone that’s always listening for a wake word, permanently on your Wi-Fi, and usually linked to your music accounts, voice assistant, and sometimes your calendar. That’s a lot of trust to put in a device’s memory safety. The exploit reportedly required contest conditions — physical or local network access per the rules for the category — which is why Sonos owners shouldn’t picture someone hacking their speaker from another continent. But “needs local access” is cold comfort when the device lives in your living room: guests, compromised IoT devices, and a breached router are all “local.”

If you own one: check for a Sonos app/firmware update now, then enable auto-updates if you haven’t. Sonos pushes firmware through the Sonos app, so the app itself needs to be current too. And while you’re in there, review which services are linked to the speaker — every linked account is another door, so unlink anything you don’t actively use.

Home Assistant Green: the local-control hub got hit too

The Home Assistant Green — the little plug-and-play box that runs Home Assistant for people who don’t want to build their own server — was compromised for roughly $30,000. Multiple teams went after it on day two, which tells its own story: when several independent researchers all find different weaknesses in the same product, it’s not one unlucky bug, it’s an attack surface worth defending.

This one stings a particular crowd. Home Assistant users are the enthusiasts — the people who chose local control precisely to avoid cloud risk. And local control did not save them here. That’s the uncomfortable lesson: keeping your data out of the cloud doesn’t help if the box in your closet has a remotely reachable flaw. Local-first is still the right architecture for privacy, but it’s not a substitute for patching.

If you own one: Home Assistant’s update mechanism is your best friend — open Settings > System > Updates and install everything pending, then turn on automatic backups (Settings > System > Backups) if you haven’t. A current backup plus a patched install is the entire playbook. And if you expose your instance to the internet at all — check twice. Our roundup of the best smart home hubs with no subscription covers the Green alongside its alternatives, and whether you actually need a hub is worth a read if this news has you questioning the whole setup.

Why this is not what you think it is

Every year, Pwn2Own results get reported two ways: as a security-industry success story, and as scary headlines. The scary version goes something like “hackers break into your light bulbs.” Here’s the reality, in four facts.

One: the contest is rigged in the hackers’ favor on purpose. Researchers get the devices in advance, work with full knowledge of the hardware, and attempt their exploits under controlled conditions — often with local network or physical access the rules explicitly allow. A successful Pwn2Own exploit proves a vulnerability exists. It does not prove a burglar can exploit it from the street.

Two: every flaw was handed to the vendors, privately. That’s the entire point of the ZDI process. Researchers don’t publish their exploit code; they submit it to ZDI, which passes it to the vendor along with a 90-day deadline. Details only become public after the vendor ships a fix or the clock runs out. The researchers got paid precisely because they disclosed responsibly.

Three: nobody has reported these being exploited in the wild. Zero-days found at Pwn2Own are, by definition, previously unknown — and there’s no evidence any attacker knew about these flaws before the contest. The realistic risk window opens if a vendor fails to patch within 90 days and details go public, or if attackers independently rediscover the bugs. Both are reasons to update promptly, not reasons to panic.

Four: this is genuinely good news for you. These flaws were found by people who get paid to report them, on devices running current firmware, before criminals found them. The alternative timeline — the same bugs discovered by someone who sells them to the highest bidder — is the one where your smart home is actually in danger. Pwn2Own is a fire drill. Fire drills are loud, and that’s the point.

The 10-minute smart-home hardening checklist

Forget the contest for a second. The same five habits that protect you against these zero-days protect you against every other smart-home threat, and most people have done exactly zero of them. Ten minutes, once:

• Turn on automatic updates everywhere. Hue app, Sonos app, Home Assistant, your phone, your router’s firmware. Every unpatched device is a device running known-vulnerable code. This single step closes more holes than everything else combined.
• Change every default password. If any device still uses admin/admin or the password printed on its sticker, change it now. Use a password manager and give each device its own password.
• Update your router and turn on its firewall. Log into your router (usually 192.168.1.1 or 192.168.0.1), install any pending firmware, and confirm the firewall is enabled. If your router is more than five years old and no longer getting updates, it’s the weakest device in your house — replace it.
• Put IoT devices on a separate network. Most modern routers can create a guest or IoT network in a few taps. Cameras, bulbs, plugs, and speakers don’t need to see your laptop or NAS. Segmentation means one compromised bulb can’t become a compromised everything.
• Turn on two-factor authentication on every smart-home account. Your Hue, Sonos, Google, Amazon, and Home Assistant Cloud accounts all support it. An attacker with your password and no second factor owns your house; with 2FA, they own nothing.
• Disable remote access you don’t use. Every “control your home from anywhere” feature is a door on the internet. If you never adjust the thermostat from the office, turn remote access off. Home Assistant users: if your instance is reachable from the internet, make sure it’s behind Nabu Casa or a properly configured reverse proxy with 2FA — not a raw port forward.
• Audit what’s linked. Open each smart-home app and remove integrations, voice assistants, and third-party services you don’t actively use. Each one is an account that can be breached and a permission you granted and forgot.
• Check the physical layer too. A smart lock with dead batteries fails open in the worst way; cameras pointed at neighbors’ windows create legal risk. Security is the whole stack, not just software. Our no-subscription home security guide covers the physical side properly.

That’s it. Nothing on that list requires buying anything, and all of it still applies after the patches ship — because the next Pwn2Own will find the next set of bugs, and the habits are what actually carry over. If you want the bigger picture on keeping a smart home private and local, our smart bulb guide and Matter explainer both touch on which architectures minimize your exposure.

FAQ

Were Philips Hue, Sonos, and Home Assistant actually hacked?

Yes — at Pwn2Own Ireland 2026, a controlled hacking contest in Cork (October 6–8). Researchers demonstrated working exploits against the Philips Hue Bridge Pro (7 zero-days, $40,000 bounty), the Sonos Era 300 ($50,000), and the Home Assistant Green (~$30,000). All findings were disclosed responsibly to the vendors; there is no evidence of in-the-wild exploitation.

Do I need to replace my Hue Bridge, Sonos speaker, or Home Assistant Green?

No. The vulnerabilities were reported to the vendors under ZDI’s 90-day responsible disclosure process, and patches are expected. Your job is to keep automatic updates on and install them when they arrive — not to throw out working hardware.

Can hackers break into my smart home through these flaws right now?

Extremely unlikely. The exploit details are private until vendors patch or the 90-day window expires, and no in-the-wild exploitation has been reported. The contest demonstrations also used conditions (local access, prepared devices) that don’t match a remote attack over the internet.

What is Pwn2Own and who runs it?

Pwn2Own is a hacking competition run by Trend Micro’s Zero Day Initiative (ZDI). Researchers earn cash bounties for demonstrating zero-day exploits against current devices and software, and every vulnerability is disclosed privately to the affected vendor with a 90-day patch window before public disclosure.

How do I know when the patches are out?

Turn on automatic updates in the Hue app (Settings > Software update), the Sonos app, and Home Assistant (Settings > System > Updates), and they’ll arrive on their own. If you prefer manual control, check those same screens once a week through the end of the year — the 90-day disclosure window runs to roughly early January 2027.

Does using Home Assistant locally instead of the cloud keep me safe from hacks like these?

It protects your privacy — your data stays in your house — but it doesn’t protect the hub itself from software flaws, as this contest proved. Local-first is still the best architecture for privacy, but the hub needs the same update discipline as any cloud device. Keep backups current and don’t expose the instance directly to the internet.

Sources

• infosecurity-magazine.com — “Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One” (Oct 6, 2026) — https://www.infosecurity-magazine.com/news/pwn2own-hackers-32-zeroday/
• thehackernews.com — “Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own” (Oct 9, 2026) — https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html
• securityweek.com — “Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own” (Oct 2026) — https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/
• bleepingcomputer.com — “Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland” (Oct 9, 2026) — https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/

The short version: three trusted smart-home devices fell at Pwn2Own Ireland 2026 — the Hue Bridge Pro, the Sonos Era 300, and the Home Assistant Green — and the system worked exactly as designed. Researchers got paid, vendors got the details privately, and patches are on the way. Your move is unglamorous and effective: updates on, passwords changed, router maintained, accounts locked down with 2FA. Do the ten-minute checklist above, and you’re better defended than the vast majority of smart homes — against this week’s zero-days and the next ones too.