“Competitors successfully gained code execution and escalated privileges on fully patched systems after hacking Windows 11, Ubuntu Desktop, VMware Workstation, Oracle VirtualBox, three web browsers (Apple Safari, Google Chrome, and Microsoft Edge), and the Tesla Model 3.”
Twenty-nine zero-days in two days, all on fully patched targets in default configuration. Manfred Paul alone broke Safari, Chrome, Edge and Firefox for $202,500. Synacktiv took over the Tesla’s CAN bus in under 30 seconds and drove off with the car. The vendors now get 90 days to fix what one contest found in a weekend.