DEVCORE Dominates Pwn2Own Berlin 2026 with $1.3M Zero Day Haul

Pwn2Own Berlin 2026 concluded on Day Three with DEVCORE crowned Master of Pwn and a final tally of $1.298 million across 47 unique zero-days discovered. The event ended with DEVCORE leading the field on every metric, finishing with 50.5 Master of Pwn points and $505,000 in payouts, while STARLabs SG came second on 25 points and $242,500, and Out Of Bounds third on 12.75 points and $95,750.

A standout on day three was splitline from the DEVCORE Research Team, who chained two bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points. OpenAI’s Codex continued to be compromised, with Satoki Tsuji of Ikotas Labs earning $20,000 and 4 points from an external control vulnerability, as the platform was exploited three times across the competition.

By the end of the three days, the competition tallied 47 zero-days and total payouts of $1,298,250, with eight more unique vulnerabilities discovered compared with Berlin 2025, according to TrendAI Zero Day Initiative.