Cybersecurity Roundup: Zero-Days, Privacy Fines, AI Vulnerabilities, and Exposed Criminal Data The past week brought significant developments in cybersecurity, from high-profile vulnerability discoveries to regulatory actions and AI-related risks. Pwn2Own Automotive Uncovers 76 Zero-Days in EV Systems The third annual Pwn2Own Automotive competition in Tokyo exposed 76 unique zero-day vulnerabilities across automotive software, including Tesla infotainment systems and EV chargers. A record 73 entries competed, with Trend Micro’s Zero Day Initiative awarding over $1 million in prizes. The winning team, Fuzzware.io, earned $215,500 and the Master of Pwn title after exploiting an out-of-bounds write flaw in the Alpitronic HYC50 EV charger. Other notable exploits included a Time-of-Check to Time-of-Use vulnerability in the same charger used to install Doom and a full takeover of Tesla’s infotainment system by Synacktiv. Automotive Grade Linux was also compromised via three separate flaws. France Fines Unnamed Company €3.5M for GDPR Violations French regulators imposed a €3.5 million fine on an undisclosed company for sharing customer loyalty data including email addresses and phone numbers with a social network for targeted advertising without explicit consent. The violations, spanning from February 2018 to December 2023, affected over 10.5 million Europeans across 16 countries. The National Commission on Informatics and Liberty cited breaches of both GDPR and France’s Data Protection Act but opted not to name the company, citing proportionality. Google Gemini Vulnerability Exposed Calendar Data via Prompt Injection Security firm Miggo identified a flaw in Google’s Gemini AI that could leak users’ private calendar details through malicious event invitations. By embedding a hidden prompt-injection payload in an event description, attackers could trick Gemini into summarizing confidential meetings into a new calendar entry potentially visible to the attacker in enterprise setups. Google patched the issue, but Miggo warned that AI systems introduce novel attack surfaces requiring dedicated security controls. HackerOne Introduces Safe Harbor for AI Security Research Bug bounty platform HackerOne released a Good Faith AI Research Safe Harbor framework to clarify rules for ethical AI testing. The guidelines protect researchers from legal action if they follow conditions such as avoiding data exfiltration, unnecessary damage, or competitive reverse-engineering. Organizations adopting the agreement commit to treating authorized AI research as legitimate, addressing ambiguity in traditional vulnerability disclosure models. Cybercriminals’ Exposed Credential Database Highlights Persistent Risks Researcher Jeremiah Fowler discovered a 96GB database containing 149 million unique login credentials including social media, banking, and government accounts left publicly accessible online. The data, likely harvested via infostealer malware, remained exposed for nearly a month before being secured. The incident underscores the ongoing threat of credential theft, even among malicious actors.