ZeroDay.Cloud 2026: Wiz cloud hacking competition with a $6.5M prize pool

ZeroDay.Cloud 2026 is a hacking competition run by Wiz. Researchers find zero click, unauthenticated remote code execution or container and VM escapes in core open source cloud software, then show them live.

The prize pool is $6.5M, paid per target. Examples: Nginx $300,000, Firecracker and gVisor $200,000, Apache2 $150,000, Redis, PostgreSQL and MariaDB $100,000, the Kubernetes API Server $80,000, and LiteLLM, vLLM and the NVIDIA Container Toolkit $40,000.

Adults can take part alone or in teams of two to five. Residents of sanctioned countries and regions, employees of Wiz, AWS, Google and Microsoft, and public sector employees are excluded. Only one team per company may enter, with the employer's permission.

Exploits must be registered by 1 December 2026 at 17:00 GMT. All contestants must finish Bugcrowd ID, tax and payout checks by 20 November. At most three contestants can enter per target and the earliest valid entries win. The live attempts take place at Black Hat Europe in London on 9 and 10 December. Target setups are published in the Wiz GitHub repository for the competition.

Quick answers

Where are the exploits shown?

On stage at Black Hat Europe in London on 9 and 10 December 2026. Each team gets three attempts.

Are travel costs covered?

No. Contestants pay their own travel.