Provenance Record

737-word News article providing comprehensive Pwn2Own Berlin 2026 coverage: day-by-day results, competitor rankings, prize totals, AI category analysis, and disclosure timeline. Well-organized with appropriate technical depth for the cybersecurity audience.

All 6 sources fetched successfully. source-0 (bleepingcomputer.com): confirmed $1,298,250 total, 47 zero-days, DEVCORE $505k/50.5pts, STARLabs $242.5k/25pts, Out Of Bounds $95.75k/12.75pts, Orange Tsai $200k Exchange, Orange Tsai $175k Edge, Palmiotti/chompie $70k for Red Hat+NVIDIA Container Toolkit, last year $1,078,750. source-1 (thezdi.com day 3): confirmed final totals $1,298,250 / 47 zero-days, DEVCORE master with 50.5pts/$505k, STARLabs 2nd, Out Of Bounds 3rd, splitline SharePoint $100k/10pts, Nguyen Hoang Thach VMware ESXi $200k/20pts. source-2 (thezdi.com day 2): confirmed Orange Tsai Exchange 3-bug chain $200k/20pts, Day 2 totals $385,750/15 zero-days. source-3 (thezdi.com day 1): confirmed $523k/24 zero-days, Angelboy+TwinkleStar03 Windows escalation, Marcin Wiązowski heap buffer overflow, k3vg3n LiteLLM SSRF/code injection $40k, Compass Security OpenAI Codex CWE-150 $40k, LM Studio chain $40k, chompie NV Container Toolkit $50k + Red Hat $20k = $70k total, Orange Tsai Edge 4-bug chain $175k. source-4 (securityweek.com): confirmed AI targets (Ollama, Claude Code, Cursor, LM Studio, LiteLLM, OpenAI Codex, NVIDIA Megatron Bridge), sign-up oversubscription with teams disclosing directly to vendors. source-5 (thezdi.com announcement): confirmed 28 zero-days last year/$1,078,750, four AI categories (AI Databases, Coding Agents, Local Inferences, NVIDIA products). Allowlist: thezdi.com is the official Trend Micro Zero Day Initiative blog — authoritative primary source for Pwn2Own.

All prize amounts, point totals, researcher names, bug types, and target products verified against ZDI day-by-day posts and BleepingComputer. Note: BleepingComputer says '29 zero-day flaws' for last year's event while ZDI announcement says '28 unique 0-days' — the article uses '28' which aligns with the ZDI primary source. No fabricated specifics detected.

Clean, thoroughly sourced cybersecurity competition wrap-up. All specifics verified. APPROVE.