Software-defined vehicles face a growing risk of cyberattack, but many of the safety systems still cannot be fixed remotely, according to eSync Alliance.
It said that when a flaw is found in a brake, steering or driver assistance controller, the fix often depends on the owner bringing the car to a workshop, which could leave the vehicle exposed for months.
Most carmakers’ over-the-air update systems were designed around the infotainment screen and the telematics unit.
The controllers that handle braking, steering and driver assistance usually come from separate specialist suppliers, each with its own way of receiving software. Many are updated only at a service, or not at all, according to eSync Alliance.
In a recent survey by automotive software company QNX, 83% of automotive software developers said they expect software-defined vehicles to become a major target for cyberattacks within the three years.
In 2025, researchers disclosed a set of flaws, known as PerfektBlue, in a Bluetooth software component supplied to several carmakers, and used them to break into the infotainment systems of Volkswagen, Mercedes-Benz and Skoda models.
The supplier released a fix in September 2024, but it had to pass through the head unit maker and the carmaker before reaching dealers, and some vehicles may still have been unpatched almost a year later.
Mike Gardner, executive director at the eSync Alliance, said: “A security flaw in a brake or steering controller is exactly what an attacker would look for, and today it is often the hardest thing to fix.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
