Tesla Infotainment System Hacked at Pwn2Own Automotive 2026
Executive Summary
Security researchers successfully hacked the Tesla Infotainment System by exploiting 37 zero-day vulnerabilities during the Pwn2Own Automotive 2026 competition, earning $516,500. The CVE-ID is currently being assigned and the status is unpatched.
Vulnerability Details
Affected Product: Tesla Infotainment System
Identifier:Pending Assignment (Zero-Day)
CVSS Score:Critical (Assessed)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Critical
Attack Vector: The Tesla Infotainment System was remotely accessed and compromised.
Ease of Exploit: High
Action Plan
Immediate Action: Patch the Tesla Infotainment System once the update is available.
Workaround: Monitor network traffic for suspicious activity.
Detection: Implement intrusion detection systems to identify potential exploits.
Relevant professional terms
Zero-day Vulnerability
A software vulnerability that is unknown to the vendor and for which no patch is yet available.
Exploit
A piece of software, a chunk of data, or a sequence of commands that takes advantage of a vulnerability to cause unintended or unanticipated behavior to occur on computer hardware, software, or something electronic.
ACF Plugin Vulnerability Allows Admin Access on WordPress Sites
Critical
Executive Summary
A critical severity vulnerability in the Advanced Custom Fields (ACF) Extended plugin for WordPress allows unauthenticated remote attackers to gain administrative permissions. The vulnerability is tracked as CVE-2025-14533 and is patched in version 0.9.2.2.
Vulnerability Details
Affected Product: Advanced Custom Fields Extended (ACFE) plugin for WordPress
Identifier: CVE-2025-14533
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching or mitigation is critical due to the high severity and potential for complete system compromise.
Attack Vector: Remote, unauthenticated attackers can exploit the vulnerability.
Ease of Exploit: Easy
Action Plan
Immediate Action: Upgrade to the latest version or apply the provided patch as soon as it becomes available.
Workaround: Implement temporary mitigations such as disabling the plugin until a patch is available.
Detection: Monitor for unauthorized administrative access and unusual activity.
Relevant professional terms
Vulnerability
A weakness in a system that can be exploited by a threat actor to perform unauthorized actions.
Exploit
A piece of software, a chunk of data, or a sequence of commands that takes advantage of a vulnerability to cause unintended or unanticipated behavior to occur on computer hardware, software, or something electronic.
Luxshare, a key Apple partner, has allegedly suffered a breach by RansomHub, with attackers claiming to have stolen and encrypted sensitive data. The attackers are threatening to leak data from Apple, Nvidia, and LG unless a ransom is paid.
Attack Overview
Attack Path: Initial access is suspected to be through typical methods such as phishing, exploiting known vulnerabilities, and password spraying.
Attacker: RansomHub
Impact Assessment
Data Stolen: Confidential 3D CAD product models, engineering design data, geometric data, component drawings, and printed circuit board data related to Apple, Nvidia, LG, Tesla and other companies.
Operational Impact: Data encryption and potential data leak.
UStrive, an online mentoring site, suffered a security lapse that exposed user data, including that of children. The incident, caused by a misconfigured GraphQL endpoint, allowed logged-in users to view other users' non-public information.
Attack Overview
Attack Path: A misconfigured GraphQL endpoint with weak authorization checks allowed unauthorized data access.
Impact Assessment
Data Stolen: Full names, email addresses, phone numbers, and potentially gender and date of birth of at least 238,000 users were exposed.
Detection & Hunting
IOCs: Examine GraphQL endpoint logs for unusual queries and access patterns.
Detection Guidance: Monitor for Broken Object Level Authorization (BOLA) flaws in GraphQL APIs.
Strategic Takeaway
Insufficient authorization checks on API endpoints can lead to significant data exposure, especially when handling sensitive user information.
Relevant professional terms
GraphQL
A query language for APIs and a runtime for fulfilling those queries with your existing data.
BOLA (Broken Object Level Authorization)
An API security vulnerability where an application fails to properly authorize access to objects based on the user's privileges.
NexShield Extension Delivers ModeloRAT via CrashFix
Executive Summary
A malicious Chrome extension, NexShield, posing as an ad blocker, crashes the browser to trick users into executing malicious commands. This leads to the installation of ModeloRAT, primarily targeting corporate environments.
Key TTPs
Initial Access: Malvertising redirects to a fake ad blocker extension on the Chrome Web Store.
Execution: Uses ClickFix technique, prompting users to execute a malicious PowerShell command copied to the clipboard via the Windows Run dialog.
Defense Evasion: Delays malicious behavior for 60 minutes after installation to avoid immediate suspicion.
Campaign Analysis
The NexShield extension creates a denial-of-service condition by exhausting browser memory resources, leading to a crash. This "CrashFix" variant then uses social engineering to trick users into running a malicious script.
Targeting & Infrastructure
Target Profile: Primarily targets domain-joined hosts in corporate environments.
Infrastructure: Uses nexsnield[.]com to track installs, updates, and uninstalls.
Actionable Intelligence
Domains:nexsnield[.]com
Relevant Terms
ClickFix: A social engineering technique that tricks users into manually executing malicious commands.
ModeloRAT: A Python-based Remote Access Trojan delivered in this campaign, enabling system reconnaissance and remote control.
Threat actors are exploiting misconfigured web applications like DVWA, OWASP Juice Shop, Hackazon, and bWAPP. The goal is to gain unauthorized access to cloud environments belonging to Fortune 500 companies and security vendors.
Key TTPs
Initial Access: Exploiting misconfigured web applications used for security training and internal penetration testing.
Campaign Analysis
Attackers are leveraging known vulnerabilities in security testing applications to target high-profile organizations. This allows them to potentially access sensitive data and disrupt services.
Targeting & Infrastructure
Target Profile: Fortune 500 companies and security vendors.
Relevant Terms
Penetration Testing: Simulating cyberattacks on a web application to identify security vulnerabilities.
Vulnerability: A weakness in a system that can be exploited by a threat actor.
VoidLink is a cloud-focused Linux malware framework, believed to be largely generated by AI, targeting Linux cloud and container environments. The malware is designed for long-term access, surveillance, and data collection within compromised systems.
Key TTPs
Defense Evasion: Employs rootkit capabilities, runtime code encryption, and adaptive behavior based on the detected environment to evade detection.
Execution: Utilizes fileless execution via memfd_create and execveat.
Campaign Analysis
VoidLink marks a turning point in malware development, showcasing how AI can enable a single actor to create sophisticated malware. Its modular design and cloud-focused capabilities pose a significant threat to Linux-based cloud services.
Targeting & Infrastructure
Target Profile: Targets Linux cloud and container environments, including AWS, GCP, Azure, Alibaba, and Tencent systems, potentially targeting software developers.
Infrastructure: Features a Chinese web-based command-and-control (C2) dashboard for remote control and management.
Relevant Terms
Rootkit: A set of tools used to hide malicious software and activity on a system.
C2 (Command and Control): Infrastructure used by attackers to control and communicate with compromised systems.
