We’re Tracking the Future of Security

Category: Vehicle & Transportation Security

  • CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA has disclosed four vulnerabilities affecting Monta’s electric-vehicle charging platform. The agency says the issues could allow unauthorized administrative actions or denial-of-service activity, making identity controls and session handling a priority for charging operators.

    Where the weaknesses appear

    The advisory identifies missing authentication and rate-limiting controls, weaknesses involving sessions, and the use of publicly accessible identifiers. CISA assigns the group a maximum CVSS v3 base score of 9.4 and lists monta.app as affected across all versions at the time of publication.

    The practical risk extends beyond a conventional web account. EV charging platforms coordinate users, chargers and operational services, so unauthorized administrative access can affect a distributed physical service. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    Mitigation and operational checks

    Monta is working toward authenticated connections and says its platform supports OCPP 1.6 Security Profile 2. The company also applies throttling and rate limits. Operators should confirm which controls are active in their own tenant and charger estate instead of assuming that a supported feature is already enabled everywhere.

    Security teams should review privileged accounts, revoke stale sessions, monitor failed authentication patterns and segment charger-management services from unrelated business systems. Any configuration change should be tested against charger availability and field-support procedures. Related developments in connected transport can be followed through SectechMedia’s vehicle and transportation security coverage.

    Sources

  • Times Car Confirms Data Breach Affecting 6.6 Million Accounts

    Times Car Confirms Data Breach Affecting 6.6 Million Accounts

    Japanese car-sharing provider Times Car has confirmed that attackers obtained information associated with approximately 6.6 million current and former customer accounts. Operator Park24 detected unauthorized access on September 25 and later verified that data stored in the affected web system had been taken by a third party.

    The exposed records include identity documents

    Park24 said the affected data varies by customer but can include names, addresses, dates of birth, telephone numbers, email addresses, driving-license information, identity-document images, account passwords and linked-service identifiers. Corporate member records may also include department names.

    The company said passwords were stored in a form that could not be restored and that credit-card data was not affected. It reported no evidence at the time of publication that the stolen information had been publicly distributed, but warned customers about phishing, impersonation messages and fraudulent calls.

    Mobility platforms hold high-value identity data

    Car-sharing services combine identity verification, transport records and account access in one environment. Operators should separate document stores, monitor privileged access and rehearse customer notification before an incident. Affected users should verify messages through official channels and avoid links requesting credentials. SectechMedia tracks related risks in its transportation security coverage.

    Sources

  • NIOSH Report Details Toxic Exposure During Electric-Vehicle Battery Fire

    NIOSH Report Details Toxic Exposure During Electric-Vehicle Battery Fire

    A new National Institute for Occupational Safety and Health investigation examines an electric-vehicle fire in California where firefighters experienced symptoms after exposure to smoke and vapors from a lithium-ion battery thermal-runaway event. The report reconstructs the response and identifies lessons for respiratory protection, hazard control and post-incident monitoring.

    Battery events can remain hazardous after visible flames

    The incident involved an electric vehicle whose battery continued to produce heat and toxic products as cells failed. NIOSH’s analysis highlights the need to treat the atmosphere around a damaged high-voltage battery as potentially hazardous throughout suppression, overhaul, towing and storage. A decline in visible fire does not by itself establish that respiratory risk has ended.

    Fire departments also need clear coordination with towing operators, hazardous-material teams and medical personnel. The handoff should document battery condition, isolation distances, re-ignition indicators and exposure concerns for everyone who may approach the vehicle later.

    Respiratory protection needs objective release criteria

    Departments should maintain self-contained breathing apparatus until monitoring and incident conditions support a documented transition. Training should cover thermal runaway, decontamination, symptom reporting and delayed medical evaluation. SectechMedia tracks related systems and operational controls in its fire and life-safety coverage.

    Sources

  • EASA Proposes New Security Rules for Drone Operations

    EASA Proposes New Security Rules for Drone Operations

    The European Union Aviation Safety Agency has issued Opinion 06/2026 proposing amendments intended to tighten the security of drone operations across Europe. The package addresses the continued growth of unmanned aviation and the need to align operational authorization with security, identification and oversight.

    From aviation safety to security assurance

    Unmanned Airspace reports that the opinion covers a broad set of changes affecting operators and authorities. EASA opinions are proposals within the European rulemaking process, not the same as rules already in force. Operators should therefore distinguish the published proposal from the legal text that may eventually be adopted.

    Security controls for drone operations can include operator identity, remote identification, protected command links, incident reporting and restrictions around sensitive locations. The practical effect depends on aircraft category, operating environment and the final implementing rules. Authorities also need systems that can consume identification data without treating every unknown aircraft as hostile.

    Implications for airspace security

    Airports, critical infrastructure operators and counter-UAS teams should follow the rulemaking because regulatory identification and operational data can improve incident assessment. They do not replace independent detection or response authority. A balanced airspace-security program must combine legal process, reliable sensor evidence and proportionate intervention.

    Sources

  • Hong Kong and Singapore Expand Facial Recognition for In-Vehicle Border Clearance

    Hong Kong and Singapore Expand Facial Recognition for In-Vehicle Border Clearance

    Hong Kong and Singapore are expanding the use of facial recognition for border checks that can be completed while travelers remain inside their vehicles. The initiatives are intended to shorten processing at high-volume land crossings while retaining identity checks that are normally performed at a staffed booth.

    How the approach changes border processing

    Biometric Update reported that Hong Kong is preparing in-car clearance at the Hong Kong–Zhuhai–Macao Bridge and examining related arrangements at the new Huanggang Port. Singapore has also been extending automated immigration clearance, including vehicle-lane processes. The common design objective is to link a traveler’s face with an authorized travel record without requiring every occupant to leave the vehicle.

    Such systems depend on controlled capture conditions, reliable document and watchlist integration, and clear procedures for exceptions. A failed match must route the traveler to a secondary process rather than be treated automatically as evidence of wrongdoing. Operators also need controls for children, passengers whose appearance has changed, poor lighting and partial occlusion inside a vehicle.

    Security and governance questions

    In-vehicle biometrics can improve throughput, but border agencies still have to manage retention, access logging and false-match risk. The technology should be evaluated as one layer within a broader access-control and identity architecture, not as a substitute for trained officers. Independent performance testing and transparent fallback procedures will be important as deployment expands.

    Sources

  • Niger Starts National Enrollment for Alliance of Sahel States Biometric Passport

    Niger Starts National Enrollment for Alliance of Sahel States Biometric Passport

    Niger has begun public biometric enrollment for the Alliance of Sahel States passport. The campaign launched on September 15 in Niamey, with the government planning additional enrollment centers across the country and services for citizens abroad.

    Officials also plan to add online pre-enrollment through domestic payment platforms. The ordinary passport is priced at FCFA 45,000, while a reduced price applies to children and students, according to the Niger News Agency and Biometric Update. Authorities say the document is designed to align with International Civil Aviation Organization requirements, although detailed certification evidence was not included in the public announcement.

    Niger follows Burkina Faso and Mali in rolling out the common AES passport. The government is presenting the program as part of a wider modernization of civil registration, identity verification and border processes. Regional expansion will also require dependable enrollment equipment, training and document supply.

    Why it matters

    A biometric passport program is not only a document project. It requires secure enrollment, trusted issuance, protected biometric data, inspection-system interoperability and accessible service delivery. Those operational controls determine whether a new credential improves border and airport security in practice.

    Sources

  • Verkada Adds Fleet Cameras, Cloud Audio and Read-Only AI Connections to Command

    Verkada Adds Fleet Cameras, Cloud Audio and Read-Only AI Connections to Command

    Verkada has expanded its Command platform with products for fleet video, cloud-managed audio and connections to external artificial-intelligence services. The additions were announced at the company’s VerkadaOne conference in Miami.

    Verkada Transportation brings vehicle camera footage and selected diagnostic data into Command through three ruggedized camera models and a gateway supporting 5G and Wi-Fi. The audio offering adds centrally managed speakers and paging functions for facilities. Catalyst uses Model Context Protocol to connect Command with approved services including Claude, ChatGPT and Gemini.

    The company says the external AI connection will initially operate in read-only mode and support natural-language creation of reports and workflows. Read-only access limits direct control risk, but organizations still need to assess what data is exposed to connected services, how prompts and outputs are logged, and whether sensitive video or identity information can leave an approved boundary.

    Why it matters

    Unified platforms are extending beyond fixed cameras and doors into vehicles, audio and AI-assisted operations. The operational benefit is a shared view, while the governance challenge is maintaining clear trust boundaries across every connected service and preserving the evidentiary controls described in video evidence chain of custody.

    Sources

  • Hardcoded Cryptographic Keys in Wärtsilä Ship Management Software Rated Critical

    Hardcoded Cryptographic Keys in Wärtsilä Ship Management Software Rated Critical

    CISA disclosed two critical vulnerabilities in Wärtsilä FOS-Onboard, fleet-management software used aboard vessels, after the flaws were reported by maritime cybersecurity firm Cydome Security. CVE-2026-78225, rated 9.1 to 9.5 depending on scoring version, is a hardcoded cryptographic server key in the software’s Update Controller component that could let an attacker deliver an unauthorized software update or execute code on affected systems.

    A second flaw, CVE-2026-81855, is a hardcoded client authentication key in a robot-testing-framework component that could let an attacker extract credentials and impersonate a privileged client. Wärtsilä said the vulnerabilities are not exploitable under its recommended installation configuration and has made a patch available to customers on request. CISA lists the affected sector as Transportation Systems, with deployment worldwide.

    Why it matters

    Hardcoded keys are a recurring failure mode in operational technology because they can’t be rotated the way a normal credential can — once exposed, every deployed unit sharing that key is affected until firmware is patched.

    Sources

  • Vehicle Barriers and Bollards: How Anti-Ram Perimeter Protection Actually Works

    Vehicle Barriers and Bollards: How Anti-Ram Perimeter Protection Actually Works

    Bollards and vehicle barriers have become a standard part of perimeter protection at government buildings, stadiums, transit hubs and commercial plazas, driven by a mix of vehicle-ramming attacks and simple traffic accidents. What looks like a decorative post or a low steel arm is, in most professional installations, a rated device engineered and tested to stop a specific vehicle at a specific speed.

    Fixed, Removable and Automatic Bollards

    Fixed bollards are permanently anchored and offer the highest reliability since there is no mechanism to fail, but they permanently block the space they occupy. Removable or retractable bollards can be taken out of the ground or lowered to allow authorized vehicle access, trading some convenience for a manual or semi-manual operating step. Automatic bollards rise and lower on command from an access control system, gate operator or guard station, letting a single lane serve both pedestrians and authorized vehicles without a fixed barrier permanently occupying the space, at the cost of added mechanical and power complexity that must be maintained.

    Crash Ratings Are Not Marketing Claims

    Serious perimeter security specifications reference independent crash-rating standards, most commonly the US State Department’s K-rating system and ASTM F2656, which test a barrier against a vehicle of a defined weight striking it at a defined speed and measure how far the vehicle penetrates past the barrier line after impact. A barrier rated to stop a 15,000-pound vehicle at 40 miles per hour behaves very differently in a real event than an unrated decorative post that merely looks similar, which is why security consultants specify barriers by their tested rating rather than their appearance.

    Barriers as Part of a Layered Approach

    Bollards and barriers are typically combined with standoff distance, planters, retaining walls, sloped grading and other landscape features that a site’s architects can use to keep vehicles away from a building without visually presenting as a fortress. Security planners generally treat the vehicle barrier line as the outermost layer of a broader protection plan that also includes access control, video surveillance and, at higher-risk sites, manned checkpoints, rather than as a standalone solution to vehicle-borne threats.

    FAQ

    What is a K-rating? K-ratings are a US State Department classification system that rates a barrier’s ability to stop a vehicle of a specified weight traveling at a specified speed, based on independent crash testing.

    Can automatic bollards fail open or closed during a power outage? Behavior varies by product and installation; many automatic bollards are specified to fail in a particular position (safe, secure, or last-known-state) depending on site requirements, which is a key design decision during installation.

    Do decorative bollards provide real vehicle protection? Only if they carry an independent crash rating for the intended threat vehicle and speed. Purely decorative posts without a tested rating should not be relied on to stop a vehicle.

  • NHTSA Opens Audit Into Tesla’s Cybercab Safety Self-Certification After Austin Launch

    NHTSA Opens Audit Into Tesla’s Cybercab Safety Self-Certification After Austin Launch

    The National Highway Traffic Safety Administration (NHTSA) has opened an Audit Query, numbered AQ26002, into the technical data and process Tesla used to self-certify that its new Cybercab complies with all applicable Federal Motor Vehicle Safety Standards (FMVSS), according to an NHTSA press release and reporting by the New York Times and Electrek. The investigation, opened September 3, 2026, covers an estimated 1,000 Cybercab vehicles and was prompted by public information, according to the filing.

    A Vehicle With No Manual Controls

    Cybercab has no steering wheel or pedals, and Tesla began putting paying passengers in the vehicles in Austin, Texas the same day the audit was opened. NHTSA said it will examine “the extent to which Tesla’s certification depended on determinations that certain FMVSS are inapplicable to the Cybercab,” according to Electrek, focusing on whether standards written for vehicles with traditional human controls can be validly waived for a fully autonomous design.

    How Self-Certification Works

    Under the US system, automakers certify their own compliance with federal safety standards rather than obtaining pre-approval from regulators, with NHTSA auditing that certification after the fact. The audit will assess the technical data and processes underlying Tesla’s compliance determination and how occupant protection is addressed in a vehicle operating without a human driver behind physical controls, according to NHTSA.

    Stakes for Tesla’s Robotaxi Rollout

    Tesla has said it plans to gradually expand Cybercab deployment to more vehicles and locations. The outcome of the audit could influence the pace of that expansion and is being closely watched as a test case for how federal vehicle safety standards, largely written around human-operated cars, apply to commercially deployed vehicles with no manual controls at all.