The 2026 Pwnie Awards

The 2026 Pwnie Awards opened with a host explaining the volunteer, unpaid format of the show and how each category would run. Presenters then walked through nominees for categories including best remote code execution, best privilege escalation, best server-side cloud bug, best mobile bug, best AI security research, most innovative research, most underhyped research, lamest vendor response, and most epic fail. Each nominee got a short, joking description of the bug or research. Examples included a KVM guest-to-host escape on ARM64, a Linux privilege escalation shared by two researchers, a zero-click audio decoding chain on Pixel phones, prompt-injection attacks against AI browsers and operations agents, and a DNS character-handling flaw affecting many implementations. Several winners were absent, so others accepted on their behalf.

The middle of the show leaned on running jokes about vendors. Microsoft's handling of several disclosed bugs drew the lamest vendor response award, and an AI chatbot prompt-injection that led to an Instagram account takeover took most epic fail. The hosts also noted that many AI-related nominees reflected how quickly new AI products were being probed.

The show closed with thanks to the volunteers and sponsors, and with a reminder that the awards depend on researchers publishing their work. For a practitioner, the ceremony is a compact snapshot of the year's notable research: zero-click mobile attacks, AI features as an attack surface, and how vendors respond to disclosure.