Pwn2Own Automotive 2026 Awards $1,047,000 for 76 Zero-Day Vulnerabilities
- Securityish
- Threats & Incidents
Quick Summary
During the Pwn2Own Automotive 2026 competition held from January 21 to January 23 in Tokyo, security researchers exploited 76 zero-day vulnerabilities, earning a total of $1,047,000. The event focused on automotive technologies, including in-vehicle infotainment systems and electric vehicle chargers. Team Fuzzware.io emerged as the top winner, securing $215,000 for their exploits, highlighting the ongoing risks associated with automotive cybersecurity.
The Securityish Brief
Pwn2Own Automotive 2026 concluded with security researchers earning $1,047,000 by exploiting 76 zero-day vulnerabilities from January 21 to January 23 in Tokyo, Japan. The competition, which is part of the Automotive World conference, targeted fully patched in-vehicle infotainment (IVI) systems, electric vehicle (EV) chargers, and car operating systems like Automotive Grade Linux.
Team Fuzzware.io won the contest, taking home $215,000 after successfully hacking an Alpitronic HYC50 Charging Station, an Autel charger, and a Kenwood DNR1007XR navigation receiver on the first day. They earned an additional $95,000 for demonstrating multiple zero-days in the Phoenix Contact CHARX SEC-3150 charging controller and other EV chargers on the second day.
Other notable participants included Team DDOS, which earned $100,750, and Synactiv, which received $85,000. The Synacktiv Team also collected $35,000 for exploiting the Tesla Infotainment System through a USB-based attack on the first day.
Implications for Automotive Cybersecurity
The significant financial rewards for exploiting these vulnerabilities underscore the critical need for robust cybersecurity measures in the automotive sector. With the increasing reliance on digital technologies in vehicles, the potential for exploitation poses risks not only to manufacturers but also to consumers.
As these vulnerabilities are disclosed, vendors have a 90-day window to develop security fixes, emphasizing the importance of timely updates and patches. Organizations should prioritize monitoring for updates related to these vulnerabilities to mitigate risks associated with potential exploitation.
This event also highlights the evolving landscape of cybersecurity threats in the automotive industry, where traditional security measures may not suffice. Stakeholders must remain vigilant and proactive in addressing these vulnerabilities to protect both vehicles and their users.
- Team Fuzzware.io: Won $215,000 for exploiting multiple automotive vulnerabilities, including chargers and navigation systems.
- Team DDOS: Secured $100,750 for their exploits during the competition.
- Synactiv: Earned $85,000 for their successful hacking attempts.
- Synacktiv Team: Collected $35,000 for exploiting the Tesla Infotainment System.
- Automotive Grade Linux: A targeted operating system during the competition.
Key Takeaways
- Ensure your vehicle’s software is up to date to protect against known vulnerabilities.
- Monitor announcements from automotive manufacturers regarding security patches and updates.
- Consider using additional security measures, such as firewalls, for connected vehicle systems.
- Stay informed about the latest cybersecurity trends and vulnerabilities in the automotive sector.
- Engage with cybersecurity professionals to assess your organization’s risk posture related to automotive technologies.
Key Terms & Concepts
- Zero-day vulnerability: In this article, a zero-day vulnerability refers to a security flaw that is exploited before the vendor has released a fix.
- In-vehicle infotainment (IVI) systems: IVI systems are integrated multimedia systems in vehicles that provide entertainment, navigation, and communication features.
- Electric vehicle (EV) charger: An EV charger is a device used to recharge electric vehicles, which can be targeted for cybersecurity exploits.
Read the original article here: https://www.bleepingcomputer.com/news/security/hackers-get-1-047-000-for-76-zero-days-at-pwn2own-automotive-2026/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
