Loading story…
Researchers at the University of California San Diego and Oberlin College demonstrated Bus Driver, a physical proof-of-concept attack against Boeing 737 avionics in a laboratory testbed. A coin-sized implant costing less than $100 can reportedly be installed in under a minute through an externally accessible, non-locking panel or unused ground-accessible maintenance connection in the electronics and equipment bay, where it injects stronger signals onto an ARINC 429 bus.
The device targeted communications between the flight-management computer and multifunction cockpit displays, enabling falsification of takeoff and landing inputs, changes to autopilot routing and operational data, and potential concealment of changes on the affected display. The researchers disclosed the issue to Boeing in 2020 and said the work was validated in Boeing laboratories; Boeing stated that layered safeguards substantially limit real-world feasibility and risk. Pilots may identify discrepancies on other cockpit displays and retain manual control, while the status of any mitigations has not been publicly disclosed.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
UC San Diego researchers published and presented research at the USENIX Security Symposium in Baltimore describing a proof-of-concept implant that accesses Boeing 737 ARINC 429 avionics buses through an unsecured ground-accessible maintenance port. The device was shown in a laboratory testbed to override bus messages and manipulate route or takeoff-related data, potentially while concealing changes on the cockpit interface.
Following the researchers' 2020 disclosure, Boeing permitted validation of the Bus Driver-based FMC/MCDU mediation attack in its own 737 test environment. The researchers reported a successful demonstration in December 2023.
University of California San Diego and Oberlin College researchers notified Boeing about the physical avionics-security findings, including the accessible maintenance-port attack vector. The researchers recommended restricting access to the port and strengthening bus protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
kaspersky.com
Open sourcekaspersky.ru
Open sourcecyberveille.ch
Open sourceusenix.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from the University of California San Diego and Oberlin College disclosed a **coin-sized hardware implant** that can be attached to an accessible Boeing 737 avionics service port to spoof commands sent between the Flight Management Computer and the cockpit display interface. In Boeing test-lab demonstrations using a custom 737 avionics test bed known as **Triton**, the team showed the device could remain concealed under a dust cap, intercept avionics traffic, and alter data such as outside air temperature, aircraft weight, and flight-plan information, creating the potential for incorrect takeoff calculations or route deviations. The researchers said they first shared the findings with Boeing more than six years ago and warned that aircraft redesign cycles could slow remediation if technical changes are required. Boeing said it reviewed component designs, installations, and interfaces and maintains that existing aircraft design and operational safeguards significantly limit real-world feasibility and risk, while the researchers recommended mitigations including blocking access to the service port, improving electrical isolation, and adding **cryptographic protections** to prevent spoofed avionics messages; the device was also reported to support remote access through in-flight Wi‑Fi.
Aug 13, 2026
Researchers disclosed **CVE-2026-32193**, a Microsoft Copilot hijack that abused an undocumented URL parameter, `?autorun=1`, to bypass the normal user-approval step and automatically run attacker-supplied prompts. By pairing that parameter with crafted input in the `q` field, an attacker could make Copilot operate within a victim’s authenticated session, search connected enterprise data including inbox contents, and send sensitive results to an attacker-controlled server. The attack could be delivered through phishing links, chat messages, webpages, or QR codes, and researchers reported it could continue even if the victim closed the Copilot tab immediately after opening it. Separate reporting tied the issue to a broader attack chain described as moving from an **AKS node root vulnerability** to a Copilot compromise, underscoring how cloud and AI weaknesses can be chained together. Researchers also described a second prompt-injection method that poisoned Copilot’s persistent memory using hidden webpage metadata, allowing later manipulation of Copilot responses and actions. The disclosures highlight risks from undocumented AI features, prompt injection, and trusted-session abuse in enterprise copilots connected to corporate data.
Aug 21, 2026
Security researcher Dan Hreszczuk of Fortify Labs demonstrated remote access to a BYD Shark 6 through an allegedly unprotected, passwordless entry point. In a controlled test near Canberra, he manipulated door locks, headlights, windscreen wipers and washer, infotainment display, audio volume, and music while the vehicle was being driven; he also tracked its location and activated the cabin microphone. The vehicle’s brakes and cameras were not accessible in the demonstration. The test showed that captured in-cabin voice audio could be used to interact with Siri on an unlocked phone and obtain personal information. The exposure highlights privacy and safety risks in connected vehicles and has renewed attention on Australia’s lack of mandatory automotive cybersecurity standards, while the government consults on potential requirements.
Sep 23, 2026