# Researchers disclose account takeover that enabled remote car commands

_Published Sunday, November 8, 2026 at 8:06 PM EST · Security · Latest · Tier 2 — Notable_

Security researchers Shubs and Sam Curry disclosed flaws that they say enabled remote commands, including unlocking doors and starting engines, on an unnamed automaker's vehicles in Australia, the United States and Canada. Shubs described testing on vehicles they owned or had permission to access.

In Australia, the researchers linked vehicle registration information to customer accounts, found embedded administrator credentials, bypassed a web application firewall and reset account passwords. A separate authentication misconfiguration let them bypass multifactor authentication and obtain app access tokens. The US and Canadian systems required a different, more complex attack chain.

## Sources

- [shubs.io](https://shubs.io/unlocking-any-car-from-x-brand-in-most-of-the-world/)

---
Canonical: https://techandbusiness.org/newswire/IIgWX6bO33kRSSAyt8k6Cq
Published: 2026-11-09T01:06:23.836Z
Story chronology: 2026-11-07T10:56:40.000Z
Retrieved: 2026-11-09T03:23:28.276Z
Publisher: Tech & Business (techandbusiness.org)