Get on Slack/Teams RSS
Last updated: July 5, 2026 at 9:01 AM UTC
All 557 Vulnerability 199 Breach 106 Threat 245 Defense 7
Tag: windows-11 (2 articles)Clear
vulnerability
2026-05-16

Pwn2Own Berlin Day 2: Microsoft Exchange falls to Orange Tsai's $200K chain, event total tops $908K

The second day of Pwn2Own Berlin 2026 added $385,750 across 15 unique zero-days, bringing the running total to $908,750 across 39 zero-days. The headline was Orange Tsai of DEVCORE chaining three bugs to gain SYSTEM-level remote code execution on Microsoft Exchange Server, taking the $200,000 top prize and pushing his event total past $375,000. Other day-two wins included a Windows 11 integer-overflow LPE, a Red Hat Enterprise Linux for Workstations root, a use-after-free in NVIDIA Container Toolkit, and AI-category exploits against LM Studio, Cursor, OpenAI Codex, and Anthropic Claude Desktop (the last as a collision with a previously known bug).

pwn2ownberlin-2026zero-daymicrosoft-exchangewindows-11rhelnvidiacursorclaude-desktopopenai-codexorange-tsaidevcorefollow-up
Check
Track Zero Day Initiative advisories over the next 90 days for the day-two Exchange chain (separate from CVE-2026-42897), Windows 11 LPE, RHEL Workstations escalation, NVIDIA Container Toolkit UAF, and the AI category bugs.
Affected
Fully patched Microsoft Exchange Server, Windows 11, Red Hat Enterprise Linux for Workstations, NVIDIA Container Toolkit, LM Studio, Cursor IDE, OpenAI Codex, and Anthropic Claude Desktop. CVEs not yet assigned; 90-day patching window.
Fix
Pre-stage update windows for Exchange Server, Windows 11, RHEL Workstations, and the AI developer tools listed. Where Cursor, Codex, and Claude Desktop run unsupervised, restrict outbound egress and code-execution scope until patches land.
vulnerability
2026-05-15

Pwn2Own Berlin Day 1: $523,000 paid for 24 zero-days - Microsoft Edge sandbox escape, three Windows 11 privilege escalations, Red Hat root, and LiteLLM, OpenAI Codex, and NVIDIA software all fall

Day one of the Pwn2Own Berlin 2026 hacking contest at OffensiveCon paid out 523,000 dollars across 24 unique zero-days, with Trend Micro's Zero Day Initiative reporting wins against fully patched Microsoft Edge, Windows 11, Red Hat Enterprise Linux for Workstations, NVIDIA Container Toolkit and Megatron Bridge, OpenAI Codex, and LiteLLM. Orange Tsai's four-bug logic chain that escaped the Edge sandbox took the biggest single prize at 175,000 dollars. An Anthropic Claude Code entry was ruled a collision (the bug was already known to the vendor). Each affected vendor now has 90 days to ship a fix before ZDI publishes technical details.

pwn2ownzero-daymicrosoft-edgewindows-11red-hatnvidialitellmopenai-codexzero-day-initiativeorange-tsai
Check
Inventory exposure to the targeted products (Edge, Windows 11, RHEL Workstations, NVIDIA Container Toolkit, LiteLLM, OpenAI Codex, Mozilla Firefox) and prepare an accelerated patch window for the next 90 days.
Affected
Fully patched Microsoft Edge, Windows 11, Red Hat Enterprise Linux for Workstations, NVIDIA Container Toolkit, NVIDIA Megatron Bridge, OpenAI Codex, LiteLLM. CVEs are not yet assigned; vendors have 90 days from May 14 to ship fixes.
Fix
Subscribe to ZDI advisory notifications and upstream vendor security feeds. As patches land over the next 90 days, prioritize Edge and Windows 11 LPE fixes - sandbox escapes plus local privilege escalations chain directly into endpoint takeover.