The moment an account can open a car door, a takeover stops being a data problem.
The Hacker News reports that two security researchers took over the login systems behind two car brands' mobile apps, reaching any customer's account and, for an owner with a connected car, releasing the door locks, helped along by a default admin:admin server password. The Hacker News also reports that CISA added four actively exploited flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog. And The Hacker News reports that an attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, then ran code on one of NEAR AI's inference servers and stole data from 18 agents and about 100 users.
Nobody claims a common cause here, but the advice writes itself: walk your own identity infrastructure looking for credentials nobody chose, and rate every account-takeover path by what the account can physically do, not by how many rows it exposes.
We do security review of payment and account flows: login, session and permission paths, with the blast radius of each role written down. A focused review takes days, not months, and you get cost and timeline within a day of describing the system.
If you run a connected product, the line between safety-critical account actions and merely sensitive ones is probably worth drawing yourself, before an incident draws it for you.