News
Tesla cybersecurity measures fail, hackers win Model 3 at hacking event
Tesla has been hacked at the Pwn2Own hacking event, and the hacking group has taken home a Tesla Model 3 and $100,000.
As electric vehicles and their significant amount of integrated software have become more common in everyday life, the security around them has become significantly more critical. In the worst-case scenario, a hacker could not only gain access to a car but could leak user data or even take control of the vehicle. Now, at the Pwn2Own hacking competition, a group of hackers successfully hacked a Tesla Model 3 and won the vehicle along with a $100,000 prize.
The successful hack completed by the group Synactiv was initially reported by the Zero Day Initiative Twitter account, revealing that the group had used a TOCTOU exploit to gain access to the vehicle.
One of the main highlights from Day One of #Pwn2Own Vancouver 2023: @Synacktiv vs the Tesla Model 3. Their successful demonstration earned them $100,000 and the car itself pic.twitter.com/d7TY5mKHxK
— Zero Day Initiative (@thezdi) March 23, 2023
CONFIRMED! @Synacktiv successfully executed a TOCTOU exploit against Tesla – Gateway. They earn $100,000 as well as 10 Master of Pwn points and this Tesla Model 3. #Pwn2Own #P2OVancouver pic.twitter.com/W61NasJPAl
— Zero Day Initiative (@thezdi) March 22, 2023
Thanks to the nature of the hacking competition, the details of how the hack was performed have not been made entirely public to avoid a security risk for Tesla owners. Still, the method the hackers used was relatively straightforward.
The TOCTOU (Time-Of-Check Time-Of-Use) exploit involves altering internal files to gain system access. In essence, the hackers are altering the files that a system will check to ensure someone actually should have access. This could, for example, involve changing login credentials to allow yourself access. However, as the name suggests, this is highly time-dependent, as it involves using the discrepancy of time between the system checking the files and a person actually being logged in.
Pwn2Own is one of the most famous hacking events in the world. It involves teams of hackers attempting to gain access to some of the most popular software available on the market. Each group of hackers and security researchers will be given a list of devices and software and a series of objectives to achieve. The first team to navigate through the list gains a cash prize. In this case, for completing this step of the competition quickest, the Synactive team won the Tesla Model 3 that they hacked.
With software becoming ever more interconnected with the vehicles we drive, focusing on keeping that software secure will only become more important as time passes. And with the increasing interconnectedness of these car systems, the consequences of not keeping these systems secure will only become more dire. Hopefully, automakers will take this threat seriously and continue to work to keep their items as safe and secure as possible.
What do you think of the article? Do you have any comments, questions, or concerns? Shoot me an email at william@teslarati.com. You can also reach me on Twitter @WilliamWritin. If you have news tips, email us at tips@teslarati.com!
News
SpaceX completes another secret Pentagon launch, adding to suspected Starshield buildout
SpaceX launched the classified USSF-385 mission from Vandenberg, landing its booster on a tenth flight.
SpaceX launched another classified mission for the U.S. Space Force from California early Saturday morning, and the Falcon 9 booster that carried it landed on a drone ship in the Pacific for the tenth time. The USSF-385 mission lifted off from Space Launch Complex 4E at Vandenberg Space Force Base at 7:00 a.m. PT.
Booster B1100 touched down on Of Course I Still Love You roughly eight and a half minutes after liftoff. It was the booster’s tenth flight and tenth successful landing, following the NROL-95 national security mission and eight Starlink launches. Its previous flight, a Starlink Group 15 mission on August 22, came just 35 days earlier. SpaceX ended its livestream shortly after the landing, which is standard for classified payloads, and neither the company nor the Space Force has said what the rocket carried.
Watch Falcon 9 launch the USSF-385 mission from pad 4E in California https://t.co/CAdbx85Ydy
— SpaceX (@SpaceX) September 26, 2026
USSF-385 is the fourth Space Force launch from the same Vandenberg pad in roughly six weeks, following USSF-366 on August 15, USSF-153 on September 10, and USSF-259 on September 17. When SpaceX flew USSF-366 in August, independent trackers noted that the rocket’s stage drop zones matched SpaceX’s Starlink Group 15 missions, pointing to Starshield, the government version of the Starlink satellite bus. The Space Force later cataloged 23 satellites after both USSF-366 and USSF-153, while USSF-259 placed 17 satellites into a different orbital plane, per KeepTrack. Launch databases describe USSF-385 the same way, though the payload remains officially unidentified.
The cadence lines up with the contracts, because in July, the Space Force awarded SpaceX $1.6 billion in task orders for 18 Falcon 9 missions from Vandenberg through the end of 2027. SpaceX also holds contracts to build pieces of that same network, which pushed its Pentagon contract total for 2026 past $8 billion.
Saturday’s flight was also the sixth and final Falcon 9 launch from Vandenberg in September, according to Spaceflight Now, while only one Falcon 9 flew from the East Coast this month as SpaceX shifts its Florida infrastructure toward Starship. Launch trackers list it as SpaceX’s 112th mission of 2026 and the 108th Falcon 9 flight of the year, with SLC-4E turned around about six and a half days after its previous launch.
The West Coast pad will not stay quiet for long, considering SpaceX has another Starlink mission scheduled from SLC-4E on September 30. Meanwhile, in Texas, the company is two days away from Starship Flight 14, which is targeting Monday at 7:15 a.m. CT for the vehicle’s first attempt to reach orbit.
News
Tesla hints at new Roadster design in surprise clip
Tesla ended its Semi event with a Roadster teaser revealing a new front light bar.
Tesla closed out its Semi event in Nevada on Thursday night with a nod to its own history, dropping a short Roadster teaser that suggests the production car will look noticeably different from the prototype first shown in 2017.
“We can’t have a Semi event without the Roadster,” Tesla engineering executive Lars Moravy told the crowd before the clip played. The line was a deliberate callback. Tesla first revealed the next generation Roadster in November 2017 by driving it out of the back of a Semi trailer at the truck’s original unveiling in Hawthorne, California.
The new video opens on trailer doors swinging apart in the dark. A thin white light bar glows across what appears to be the nose of the car, Tesla and SpaceX logos flash over the frame, and the Roadster name appears before the clip ends on “See you next week.” Tesla posted the nine second clip on X after the livestream wrapped.
See you next week pic.twitter.com/BT52bGVxFu
— Tesla (@Tesla) September 25, 2026
The light bar is the most concrete design detail so far. The 2017 prototype used two separate curved headlamp pods, while a connected front light strip would bring the Roadster in line with the Cybertruck, Cybercab, Semi, and refreshed Model Y. Sawyer Merritt was among the first to point out what looked like part of a SpaceX logo in the video, something Tesla has not addressed.
That logo fits the buildup around the optional SpaceX Package, which Elon Musk has long said would use cold gas thrusters to improve acceleration and possibly allow the car to briefly leave the ground. Tesla’s “Go for launch” post on September 12 set the October 1 date, and invitations sent to reservation holders place the event in Waco, Texas, at 8:30 p.m. Eastern. Waco sits roughly 20 minutes from SpaceX’s McGregor rocket test site, where the FAA has put a temporary flight restriction in place from September 18 through October 2, covering a 1.5 nautical mile radius from the surface up to 10,000 feet.
Tesla is also taking money ahead of the reveal. The company reopened Roadster reservations earlier this week with a $5,000 refundable card payment, followed by a $45,000 wire transfer due within 10 days. That puts buyers at $50,000 committed before Tesla has published a price.
The original pitch set a high bar: 0 to 60 mph in 1.9 seconds before any upgrades, 620 miles of range, a top speed above 250 mph, and production in 2020. That timeline has slipped repeatedly, and Tesla has since pointed to production at Gigafactory Texas no earlier than 2027. The company has said next Thursday’s event will include pricing, specifications, and production targets, the three details original reservation holders have been waiting on for nearly nine years.
News
Tesla Full Self-Driving release in the EU gets delayed
Tesla Full Self-Driving’s release in Europe is set to be delayed by at least a few months.
The European Union will not vote on Tesla’s Full Self-Driving (Supervised) on October 6. The draft agenda for the 119th meeting of the Technical Committee on Motor Vehicles lists only a 25-minute “continuation of discussions” on the Netherlands’ Article 39 request, not a decision. The next scheduled TCMV session is in December, which is now the earliest date a bloc-wide vote could occur.
Tesla Europe had pointed to October 6 as a possible EU-wide vote after the Dutch vehicle authority RDW granted the first European type approval on April 10.
That approval, under UN Regulation 171 plus an Article 39 exemption in EU Regulation 2018/858, is the legal file other member states have been recognizing one by one. The same committee has already discussed the request twice without voting.
Elon Musk’s reply to the delay was a single word: “Sigh.”
Sigh
— Elon Musk (@elonmusk) September 25, 2026
Seven EU countries have now cleared FSD Supervised on their own roads: the Netherlands, Lithuania, Estonia, Denmark, Belgium, Slovenia, and Czechia. Those seven states represent about 53 million people, or roughly 12 percent of the EU population. An EU-wide authorization still needs a qualified majority: at least 15 of 27 member states representing 65 percent of the bloc’s population, about 292 million people.
Germany, France, Italy, and Spain remain the decisive markets. France has already rejected the current system; several other governments have flagged speed-limit compliance as the main sticking point.
The safety case Tesla is putting in front of those governments is now public. On September 1, Tesla Europe said FSD Supervised was in use by more than 70,000 customers, covering over 1 million kilometers a day, and was 4.1 times less likely to be involved in a crash than manual driving across 100 million kilometers on EU public roads.
An earlier mid-year cut of the same fleet data, covering 65 million kilometers in five approved countries, put the collision advantage at 5.2 times, with zero highway collisions over 41.9 million kilometers. Tesla also reported far fewer automatic emergency braking events, harsh accelerations, and hard swerves than in comparable manual Tesla driving. Those figures are company-reported, not independently audited.
Tesla Full Self-Driving is taking over Europe: fourth country gets FSD approval
The public-health backdrop is harder to dispute. European countries recorded about 19,400 road deaths in 2025, or roughly 53 a day, most of them attributed to human error. FSD Supervised is not unsupervised autonomy; the driver remains legally responsible. But the software is already legal and in daily use across seven member states.
Until TCMV votes, the rest of the EU remains a patchwork: available in Prague and Amsterdam, locked behind review in Paris and Berlin. December is now the next chance to close that gap.