Over $1 Million Awarded for 28 Zero-Days at Pwn2Own Berlin
The acclaimed Pwn2Own hacking antagonism already afresh larboard its mark at OffensiveCon in Berlin, Germany, absolute yet addition blood-tingling and impactful edition. This year’s accident brought calm aristocratic aegis advisers from about the apple for three canicule of intense, high-level accomplishment demonstrations, reaffirming Pwn2Own’s acceptability as one of the arch showcases of cybersecurity aptitude and innovation. Held from May 15 to May 17, 2025, this year’s challenge was abnormally notable as it apparent the aboriginal time the antagonism was hosted in Europe. Organized by Trend Micro’s Zero Day Initiative (ZDI), the accident brought calm top aegis advisers from about the apple to advertise their abilities in advertent and base zero-day vulnerabilities.
In an absorbing advertise of cybersecurity expertise, advisers at Pwn2Own Berlin 2025 becoming a accumulated $1,078,750 by advertent and demonstrating 28 ahead alien vulnerabilities—commonly accepted as zero-day exploits. These analytical flaws spanned a advanced ambit of categories, including virtualization, web browsers, action applications, servers, bounded advantage accretion (EoP), billow and alembic technologies, automotive systems, and alike AI platforms.
Pwn2Own is a acclaimed hacking antagonism area ethical hackers and cybersecurity pros go head-to-head to acquisition and accomplishment analytical zero-day vulnerabilities in today’s best accepted accessories and software. The goal? To appearance aloof how secure—or insecure—modern tech absolutely is.
Winners not alone booty home austere banknote prizes but additionally get to accumulate the accessories they’ve auspiciously hacked.
After the event, the companies abaft the afflicted articles are accustomed 90 canicule to fix the vulnerabilities. Once that window closes, the Zero Day Initiative (ZDI), which runs the competition, about discloses the details—whether a application is accessible or not.
Day 1 Highlights from Pwn2Own Berlin 2025
The aboriginal day of Pwn2Own Berlin 2025 kicked off with a bang, as aegis advisers approved a alternation of absorbing exploits, cutting up a absolute of $260,000 in award-winning money.
The standout win of the day came from Billy and Ramdhan of STAR Labs, who pulled off a successful Docker Desktop escape by leveraging a Use-After-Free (UAF) vulnerability. Their accomplishment becoming them a air-conditioned $60,000 and 6 Master of Pwn points—making them the top scorers of the day.
Not far behind, Team Prison Breach showcased a able accumulation overflow advance to breach out of Oracle VirtualBox and accretion cipher beheading on the host machine. That becoming them $40,000 and 4 Master of Pwn points.
Day 2
Day 2 of Pwn2Own Berlin turned up the heat, with researchers earning an impressive $435,000 for a series of successful and creative exploits. That pushed the absolute award-winning basin so far to an absorbing $695,000.
One of the best arresting moments of the day came from Nguyen Hoang Thach of STARLabs SG, who fabricated Pwn2Own history. With a distinct accumulation overflow, he managed to accomplishment VMware ESXi—an acutely boxy target—securing the better accolade of the day: $150,000.
Another notable achievement came from the team at Viettel Cyber Security. They accomplished a adult advance on Microsoft SharePoint, accumulation an affidavit bypass with an afraid deserialization flaw. The result? Complete system compromise and a $100,000 reward.
In total, 20 different zero-day vulnerabilities were baldheaded throughout the day, appearance it as one of the best active and high-stakes canicule in the competition’s history.
Day 3
The final day of Pwn2Own Berlin 2025 captivated up with addition beachcomber of absorbing hacks, as advisers connected to advertise their abilities beyond a ambit of targets. A absolute of $383,750 in award-winning money was awarded on Day 3 alone, capping off an acute and groundbreaking competition.
The top prize of the day went to Corentin BAYET of REverse Tactics, who earned $112,500 and 11.5 Master of Pwn points. His accomplishment targeted VMware ESXi and accumulated a different accumulation overflow with an already accepted issue, authoritative it a partially colliding but still acceptable entry—a acute and accomplished move that paid off big.
Also authoritative a able appulse were Thomas Bouzerar and Etienne Helluy-Lafont from Synacktiv. They changed a heap-based buffer overflow to surmount VMware Workstation and received both $80,000 and 8 Master of Pwn points. Day 3 was filled with intense and risky moments which made the competition end exitingly and notably with rare skills, imaginative tricks and considerable prizes.
Pwn2Own Berlin 2025: Competition Wrap-Up
Pwn2Own Berlin 2025 came to a abutting afterwards three action-packed canicule of cutting-edge hacking, with advisers apprehension a absolute of 28 never-before-seen zero-day vulnerabilities—including seven in the aboriginal AI category. Altogether, contestants absolved abroad with a amazing $1,078,750 in award-winning money.
Leading the backpack was STAR Labs SG, who not alone bedeviled the accident with a alternation of high-impact exploits but additionally anchored the coveted Master of Pwn title. They becoming an absorbing $320,000 and 35 points, proving their accomplishment beyond assorted targets. Viettel Cyber Aegis anchored additional place, showcasing able advance chains and walking abroad with $155,000 and 15.5 points. Rounding out the top three was REverse Tactics, who delivered standout work—especially on Day 3—and becoming $112,500 and 11.25 points. It was a battleground copy of Pwn2Own, with innovation, strategy, and abstruse accomplishment on abounding affectation from some of the best aegis minds in the world.
