A password nobody ever changed can be enough to open a stranger's car door. The Hacker News reports that two security researchers got into the login systems behind two car brands' mobile apps through a default admin:admin server password, which handed them any customer's account, and for an owner with a connected car, the ability to open the doors and start the engine. The same outlet reports CISA added actively exploited flaws in GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex to its Known Exploited Vulnerabilities list, and that an attacker used a remote code execution flaw in the open-source inference engine SGLang to run code on a NEAR AI inference server, taking data from 18 agents and about 100 users. Worth an hour this week: sweep your own login and admin systems for default credentials, and treat any account-takeover path on a product that opens, moves or pays as a physical-safety bug instead of a ticket in the backlog. We review payment and account flows for exactly these paths, including systems we did not write and nobody documented. A focused review takes days, not months. Write to us through the form on our site and we will come back with cost and timeline within a day.
Was this useful?