Quick Summary
At the Pwn2Own Automotive 2026 competition, security researchers hacked Tesla’s Infotainment System, exploiting 37 zero-day vulnerabilities and earning $516,500. The Synacktiv Team earned $35,000 for gaining root permissions through an information leak and an out-of-bounds write flaw. This event highlights ongoing cybersecurity risks in automotive technologies, as vendors face pressure to release security fixes within 90 days.
The Securityish Brief
The Pwn2Own Automotive 2026 competition took place from January 21 to January 23 in Tokyo, Japan, focusing on automotive technologies. On the first day, researchers demonstrated significant vulnerabilities, including 37 zero-days, which led to substantial cash awards totaling $516,500. The Synacktiv Team successfully exploited the Tesla Infotainment System by chaining an information leak and an out-of-bounds write flaw, earning $35,000. They also exploited vulnerabilities in the Sony XAV-9500ES digital media receiver, gaining root-level code execution and receiving an additional $20,000.
Other teams also showcased their skills; Fuzzware.io earned $118,000 by hacking an Alpitronic HYC50 Charging Station, an Autel charger, and a Kenwood DNR1007XR navigation receiver. PetoWorks was awarded $50,000 for exploiting three zero-day bugs to gain root privileges on a Phoenix Contact CHARX SEC-3150 charging controller. Team DDOS earned $72,500 for hacking the ChargePoint Home Flex, the Autel MaxiCharger, and the Grizzl-E Smart 40A vehicle charging station.
On the second day, multiple teams targeted the Grizzl-E Smart 40A and the Autel MaxiCharger, with each successful hack earning $50,000. The competition emphasizes the importance of addressing vulnerabilities in fully patched in-vehicle infotainment systems, electric vehicle chargers, and car operating systems like Automotive Grade Linux.
Vendors are given 90 days to develop security fixes before TrendMicro’s Zero Day Initiative publicly discloses the vulnerabilities. This timeline puts pressure on manufacturers to ensure their systems are secure, especially as the automotive industry increasingly relies on complex software.
Implications for Cybersecurity
This event underscores the growing cybersecurity risks associated with automotive technologies. As vehicles become more connected, the potential for exploitation increases, making it crucial for manufacturers to prioritize security in their designs.
Organizations and everyday users should be aware of the vulnerabilities that can arise from connected systems. Regular updates and patches are essential to mitigate risks associated with zero-day vulnerabilities.
Monitoring for security updates from manufacturers and ensuring that devices are running the latest software can help protect against potential exploits. Users should also consider the security measures in place for their electric vehicle chargers and infotainment systems.
Key Takeaways
- Regularly check for software updates for your vehicle’s infotainment system and charging stations.
- Monitor announcements from manufacturers regarding security patches for automotive technologies.
- Consider the security features of electric vehicle chargers before purchasing or using them.
- Stay informed about vulnerabilities in connected automotive systems to understand potential risks.
- Encourage manufacturers to prioritize cybersecurity in their product designs.
Key Terms & Concepts
- Zero-Day: In this article, a zero-day refers to a vulnerability that is exploited before the vendor has released a fix.
- Infotainment System: An infotainment system is an integrated system in vehicles that provides entertainment and information to drivers and passengers.
- Root Privileges: Root privileges allow a user to have full control over a system, enabling them to make any changes or access any files.
- Pwn2Own: Pwn2Own is a hacking competition where security researchers demonstrate vulnerabilities in software and hardware for cash rewards.
Read the original article here: https://www.bleepingcomputer.com/news/security/tesla-hacked-37-zero-days-demoed-at-pwn2own-automotive-2026/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
