Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900K

Feed highlights major vulnerability disclosures and active exploitation across May 14–15, 2026: Pwn2Own Berlin paid researchers large rewards (Day 1: $523K; Day 2: $385.75K, $908,750 total) for dozens of zero-days. Microsoft confirmed active exploitation of an Exchange Server XSS zero-day (CVE-2026-42897). Researchers disclosed Windows zero-days (YellowKey affecting BitLocker; GreenPlasma affecting CTFMON). CISA added a critical Cisco Catalyst SD‑WAN flaw (CVE-2026-20182, CVSS 10.0) to its Known Exploited Vulnerabilities catalog. New kernel/local‑privilege issues include Fragnesia (Linux, CVE-