Hackers Exploit 29 Zero-Day Vulnerabilities at Pwn2Own Automotive 2026
- Securityish
- Threats & Incidents
Quick Summary
During the Pwn2Own Automotive 2026 event in Tokyo, security researchers exploited 29 unique zero-day vulnerabilities, earning $439,250 in cash awards. The competition, held from January 21 to January 23, focuses on electric vehicle technologies, including EV chargers and in-vehicle infotainment systems. With a total of 66 zero-days exploited so far, this event highlights significant cybersecurity risks in automotive technology.
The Securityish Brief
The Pwn2Own Automotive 2026 contest, taking place in Tokyo from January 21 to January 23, has seen security researchers exploit 29 zero-day vulnerabilities on its second day, resulting in $439,250 in cash awards. Participants target fully patched electric vehicle (EV) chargers, in-vehicle infotainment (IVI) systems, and car operating systems, such as Automotive Grade Linux. The event underscores the vulnerabilities present in modern automotive technologies.
Wiz Fuzzware.io leads the competition with $213,000 earned, having successfully hacked the Phoenix Contact CHARX SEC-3150 charging controller, the ChargePoint Home Flex EV charger, and the Grizzl-E Smart 40A EV charging station. Additionally, Sina Kheirkhah from Summoning Team earned $40,000 by exploiting the Kenwood DNR1007XR navigation receiver and the ChargePoint Home Flex.
Other notable participants include Rob Blakely of Technical Debt Collectors and Hank Chen of InnoEdge Labs, each awarded $40,000 for demonstrating zero-day exploit chains targeting Automotive Grade Linux and the Alpitronic HYC50 charging station. After two days, the total cash awards reached $955,750 for 66 zero-day vulnerabilities.
Implications for Cybersecurity
The Pwn2Own contest serves as a critical reminder of the cybersecurity risks associated with automotive technologies. As researchers demonstrate the ease of exploiting these vulnerabilities, it raises concerns for manufacturers and consumers alike. Vendors have a 90-day window to address these flaws before they are publicly disclosed, emphasizing the need for timely security updates.
Organizations involved in the automotive sector should take note of these findings and prioritize security measures for their products. Regular updates and patches can help mitigate the risks associated with zero-day vulnerabilities. Furthermore, consumers should remain vigilant about the security of their vehicles and related technologies.
This event also highlights the importance of ongoing security research in identifying and addressing vulnerabilities before they can be exploited by malicious actors. By understanding the techniques used in these exploits, organizations can better prepare their defenses against potential attacks.
Key Takeaways
- Ensure that all automotive software and firmware are regularly updated to protect against known vulnerabilities.
- Monitor security advisories from manufacturers for any reported zero-day vulnerabilities and associated patches.
- Consider implementing additional security measures, such as firewalls or intrusion detection systems, for connected vehicles.
- Educate users about the importance of cybersecurity in automotive technologies and encourage them to report any suspicious activity.
- Engage with cybersecurity professionals to assess and improve the security posture of automotive products.
Key Terms & Concepts
- Zero-Day Vulnerability: In this article, a zero-day vulnerability refers to a security flaw that is exploited before the vendor has released a fix.
- Pwn2Own: Pwn2Own is a hacking contest where security researchers demonstrate vulnerabilities in software and hardware for cash rewards.
- In-Vehicle Infotainment (IVI): In this context, IVI systems refer to the multimedia and information systems integrated into vehicles.
- Automotive Grade Linux: Automotive Grade Linux is an open-source platform for automotive applications and systems.
Read the original article here: https://www.bleepingcomputer.com/news/security/hackers-exploit-29-zero-day-vulnerabilities-on-second-day-of-pwn2own-automotive/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
