Pwn2Own Automotive 2026 uncovers 76 zero-days, pays out more than $1M

Infosec roundup: the Pwn2Own Automotive contest exposed 76 zero-day vulnerabilities across automotive targets (including Tesla infotainment and EV chargers) with several successful exploit demonstrations; Google Gemini was vulnerable to a calendar-based prompt-injection that could leak meetings (now patched); French regulators fined a company €3.5M for unlawful customer data sharing; HackerOne published safe-harbor guidance for AI security research; and a ~149 million-credential dataset, apparently compiled by infostealer/keylogger malware, was found publicly exposed.