Pwn2Own Automotive 2026 set a new record with 76 unique zero-day vulnerabilities discovered, exposing the rapidly expanding attack surface across SDVs, IVI systems, and EV charging infrastructure. The final day crowned Fuzzware.io as Master of Pwn 2026, with 28 Master of Pwn points.
Day 2 delivered 29 new zero-days, pushing the total to a record 66. Researchers repeatedly compromised Level 2/3 EV chargers and IVI systems using practical flaws like exposed interfaces and command injection. The takeaway: automotive and charging infrastructure attacks are now repeatable at scale—shifting cyber risk from theoretical to immediate operational impact.
Pwn2Own Automotive 2026 Day 1 opened with record-breaking momentum, with researchers successfully compromising infotainment systems, EV chargers, and Tesla interfaces—highlighting how expansive today’s automotive attack surface has become. The surge in entries and chained exploits confirms a clear shift: in the SDV era, automotive cyber risk is no longer isolated to the vehicle, but systemic across the entire ecosystem.
Traditional vulnerability management platforms overlook zero-day vulnerabilities, putting the automotive industry at risk. Discover how xZETA provides more visibility into vulnerabilities to help the industry stay ahead of emerging threats.
Today’s threats move so fast that static threat analysis and risk assessment (TARA) can no longer keep up. We discuss how dynamic TARA gives organizations the edge, with faster response, tighter collaboration, and continuous protection.
As AI assistants become standard features in vehicles, new risks like prompt injection are emerging, quietly manipulating systems through seemingly harmless inputs. We explore how attackers could exploit invisible commands in everyday interactions and why securing AI at the input level is critical to automotive safety.
We analyze the three-bug exploit chain demonstrated by security researchers against the Pioneer DMH-WT7600NEX IVI system at Pwn2Own Automotive 2024. We map it to the Automotive Threat Matrix and highlight industry best practices for mitigating similar exploits.
As AI, EVs, and SDVs reshape the automotive industry, cyberthreats are evolving in tandem. Drawing from VicOne’s 2025 automotive cybersecurity report, this article offers key insights into the industry’s threat landscape and outlines the strategies automakers need to stay ahead.
Security researchers uncovered a vulnerability in Subaru’s in-vehicle infotainment (IVI) system admin panel, enabling unauthorized access to personal information, GPS records, and vehicle controls. We examine the findings and emphasize the need for automotive manufacturers to adopt a security-first approach throughout the vehicle lifecycle.
Effective attack path identification enables automotive manufacturers and suppliers to stay ahead in an increasingly complex threat landscape. Learn how VicOne xZETA combines AI and curated automotive threat intelligence to streamline product security risk assessment, minimize manual efforts, and deliver actionable insights.
We examine a zero-click remote code execution (RCE) vulnerability in Tesla’s tire pressure monitoring system (TPMS), uncovered by Synacktiv researchers at Pwn2Own Vancouver 2024, and highlight its implications for connected vehicle security.
The ZDI has identified six zero-day vulnerabilities in an in-vehicle infotainment (IVI) system. As these vulnerabilities remain unpatched, we recommend security best practices to minimize their potential risks and fortify connected vehicles’ IVI systems.