{"data":{"id":44,"lang":"en","title":"Pwn2Own Automotive 2026: Hackers Earn Nearly $1 Million Exploiting 66 Zero-Days in Tesla, EV Chargers","summary":"Security researchers earned $955,750 exploiting 66 zero-days in Tesla and EV charging systems at Tokyo hacking competition.","category":"technology","category_label":"Technology","published_at":"2026-01-22T14:32:07Z","updated_at":"2026-01-22T14:32:07Z","url":"https://techtools.cz/tools/news/article/44-pwn2own-automotive-2026-hackers-earn-nearly-1-million-exploiting-66-zero-days","api_url":"https://techtools.cz/news-api/v1/articles/44?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/44.md?lang=en","image_url":"https://www.bleepstatic.com/content/hl-images/2024/01/24/Pwn2Own_Tokyo_headpic.jpg","word_count":128,"reading_time_minutes":1,"sources":[{"url":"https://www.bleepingcomputer.com/news/security/tesla-hacked-37-zero-days-demoed-at-pwn2own-automotive-2026/","domain":"bleepingcomputer.com"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-29-zero-day-vulnerabilities-on-second-day-of-pwn2own-automotive/","domain":"bleepingcomputer.com"},{"url":"https://www.helpnetsecurity.com/2026/01/22/pwn2own-automotive-2026-vulnerability-disclosure/","domain":"helpnetsecurity.com"}],"translation":null,"content":"Security researchers have earned nearly $1 million in just two days at Pwn2Own Automotive 2026, exploiting 66 zero-day vulnerabilities in Tesla infotainment systems, EV charging stations, and automotive navigation receivers.\n\nThe competition in Tokyo has seen dramatic results. Synacktiv successfully chained two vulnerabilities—an information leak and out-of-bounds write—to fully compromise the Tesla Infotainment System, earning $35,000. Team Fuzzware.io leads the leaderboard with $213,000 after hacking multiple charging stations including the Phoenix Contact CHARX SEC-3150, ChargePoint Home Flex, and Grizzl-E Smart 40A.\n\nDay one yielded $516,500 across 37 zero-days, while day two added $439,250 from 29 more exploits. Targets included Sony, Alpine, and Kenwood multimedia receivers, plus charging infrastructure from Alpitronic and Autel. Vendors now have 90 days to patch before public disclosure."}}