Breakthrough Hacks and Record Bounties Define Pwn2Own Berlin 2025 – Day 2
Day 2 of Pwn2Own Berlin 2025 shattered records and expectations, as cybersecurity researchers unveiled critical, previously unknown vulnerabilities across core enterprise technologies—claiming an impressive $435,000 in rewards in a single day.
Staged during OffensiveCon, the prestigious hacking competition brought the spotlight to platforms considered cornerstones of enterprise IT: VMware ESXi, Microsoft SharePoint, Mozilla Firefox, and Red Hat Enterprise Linux. Each was successfully breached, signaling systemic cracks in today’s most trusted digital infrastructure.
In a landmark first, Nguyen Hoang Thach of STARLabs SG made Pwn2Own history by executing the competition’s inaugural exploit against VMware ESXi. His attack, which leveraged a single integer overflow flaw to compromise the hypervisor, earned him $150,000 and 15 Master of Pwn points. The exploit raises red flags for global IT teams, as ESXi underpins countless enterprise data centers.
Microsoft SharePoint—integrated into thousands of business environments—was also compromised. Dinh Ho Anh Khoa of Viettel Cyber Security cleverly chained an authentication bypass with an insecure deserialization flaw, gaining unauthorized system access. The effort netted him $100,000 and 10 Master of Pwn points, underscoring the potential for serious data exposure in collaborative environments.
The day also revealed persistent threats in user-facing software. Researchers Edouard Bochin and Tao Yan from Palo Alto Networks exposed an out-of-bounds write in Mozilla Firefox, securing $50,000 and 5 points, and reminding defenders that browser hardening is still far from complete.
Security cracks emerged in the Linux world as well. Gerrard Tai of STARLabs SG exploited a use-after-free bug in Red Hat Enterprise Linux, escalating privileges and earning a modest yet notable $10,000—solidifying STARLabs’ commanding position on the leaderboard.
Meanwhile, the newly introduced AI category continued to drive innovation—and concern. A trio from Wiz Research—Benny Isaacs, Nir Brakha, and Sagi Tzadik—found a use-after-free vulnerability in Redis, which earned them $40,000 and 4 points. On the AI front, Ho Xuan Ninh and Tri Dang of Qrious Secure also pulled off a complex multi-step exploit, chaining four separate bugs to breach NVIDIA’s Triton Inference Server. Their work earned $30,000 and 3 points.
Rounding out the day, Oracle VirtualBox fell when Viettel Cyber Security again struck gold—this time with a guest-to-host escape via out-of-bounds write, securing another $40,000.
As the day concluded, the Zero Day Initiative confirmed the staggering totals:
“We’ve now awarded $435,000 today, bringing the cumulative payout to $695,000. With one more day to go, crossing the $1 million mark is a real possibility.”
With 20 unique zero-day exploits disclosed in just two days, the competition not only highlights elite technical skill but also exposes widespread vulnerabilities across enterprise and AI ecosystems. All exploits are responsibly disclosed, with vendors receiving a 90-day window to deploy patches before details go public.
As Pwn2Own Berlin prepares for Day 3, attention turns to upcoming attempts against Windows 11, Oracle VirtualBox, VMware, Firefox, and NVIDIA systems—and the growing intersection of cybersecurity and artificial intelligence.
