Swedish developer Einride deployed four cabless electric autonomous trucks at Lorenz Snacks' production facility in Neunburg vorm Wald, Germany, each carrying 15 pallets and handling up to 1,200 pallet movements daily between production and warehousing. The five-year commercial transport operation, rather than a short demonstration, signals growing adoption of driverless electric vehicles for internal industrial logistics in Europe.
New Jersey bill S1677 would establish a three-year fully driverless pilot run by the state DOT and Motor Vehicle Commission, requiring pilot vehicles to carry a camera system plus two distinct sensing modalities for obstacle detection. The sensor mandate effectively excludes camera-only Tesla vehicles, setting a hardware precedent for state-level robotaxi regulation.
Houston-based Bot Auto, led by former TuSimple CEO Xiaodi Hou, completed a 231-mile driverless Class 8 truck run from Houston to Dallas in late April 2026 at $1.89 per mile, below human driver costs. The company claims the first fully driverless commercial truckload in U.S. history, positioning autonomous trucking as a capacity business backed by a $20 million war chest.
Toronto-based Waabi launched its first customer freight operation using a Volvo VNL heavy-duty truck equipped with its Waabi Driver, hauling loads for Warp Technology along the Dallas-Houston corridor in Texas with a safety driver onboard. The deployment marks Waabi's transition from testing to commercial freight service and expands driverless-ready trucking activity in the US Sun Belt.
CERT-In published Vulnerability Note CIVN-2026-0537 on 4 November 2026 covering four high-severity flaws in Tata Motors iRA 2.0 and iRA.ev connected-car apps, which handle vehicle status, battery health, trip data and remote commands. Tata Motors Passenger Vehicles told PTI the fixes were rolled out in August and September and that no customer data was compromised. Owners running affected app versions should update immediately. The advisory underscores regulatory scrutiny of connected-vehicle app security in India.
NHTSA opened defect petition DP26010 on October 9, 2026, into claims that Tesla robotaxis exceed posted speed limits in active school zones, covering roughly 1,000 model-year 2026 Model Y and Cybercab vehicles. The review could lead to a recall or software fix. The investigation adds regulatory scrutiny to Tesla's robotaxi rollout over safety performance.
Lyft announced it will expand its Waymo robotaxi fleet in Nashville by the end of the year. The partnership pairs Waymo's autonomous driving technology with Lyft's ride-hailing network in a new US market. The move signals growing commercial scale for robotaxi operations beyond Waymo's original launch cities.
An analysis by Not a Tesla App found that Tesla's Robotaxi service geofences in Austin and other launch cities are smaller than the areas publicly advertised. The narrower operating boundaries suggest Tesla's driverless ride-hailing coverage remains more limited than marketing implies, tempering claims about the scale of its robotaxi deployment.
Waymo announced Munich as its first EU robotaxi city, planning manual mapping drives within weeks and paid driverless ride-hailing by late 2027, though it lacks a German permit. Munich is the first EU city where a US robotaxi operator has committed to public driverless service, setting a regulatory precedent for European expansion.
Driverless cars will be tested in residential communities in Ras Al Khaimah, United Arab Emirates. The trials mark continued expansion of autonomous vehicle testing across the UAE. Gulf states are positioning themselves as early adopters of robotaxi and autonomous mobility services.
Tesla submitted its sworn response to NHTSA's Special Order on Cybercab federal safety certification by the October 30 deadline, requesting full confidentiality. Only a 30-page firefighter guide is public, with all details on how the steering-wheel-free vehicle was certified redacted. NHTSA opened the order after Tesla began charging for Cybercab rides in Austin on September 3, with penalties up to $139 million for incomplete answers.
Škoda Auto suffered a data breach that compromised customer information, exposing affected individuals to phishing and follow-on fraud. The incident centers on Škoda's e-commerce and customer-facing digital platforms rather than vehicle systems, and no technical root cause or CVE is disclosed in the available reporting. For the industry, the breach reinforces that customer data stores and retail platforms are as attractive to attackers as connected vehicle backends. Affected customers should expect targeted phishing attempts, and Škoda faces pressure to disclose scope and remediation details.
South Korean police are cracking down on Tesla owners who jailbreak Full Self-Driving software in their vehicles. The enforcement action targets unauthorized modifications to Tesla's driver-assistance system. The case signals growing regulatory scrutiny of consumer tampering with ADAS and autonomous driving software in Asian markets.
Einride deployed four cab-less autonomous electric trucks into daily service at Lorenz Snacks' plant in Neunburg vorm Wald, Germany, moving up to 1,200 pallets per day under a five-year service agreement. The trucks replace diesel vehicles and charge on solar power. The deployment demonstrates commercial-scale driverless electric freight operations at an industrial site in Germany.
French appointment-booking provider Auto-Planning, which serves more than 450 vehicle inspection centres, confirmed a cyberattack claimed by the Operation GlassLodge group. Potentially compromised data includes appointments dating back to 2008, personal identities and vehicle registration plates, though Auto-Planning disputes the volumes claimed by attackers. The company notified the CNIL data protection authority. The incident exposes supply-chain risk in automotive service platforms and raises GDPR notification and data-protection implications.
Amazon-owned Zoox plans to expand its robotaxi testing into Europe and Asia. The company currently tests its purpose-built autonomous vehicle in US cities. The expansion would place Zoox in direct competition with Waymo and Chinese robotaxi operators in international markets.
A woman's ex-partner used the Tesla mobile app to remotely control her vehicle, resetting the dashboard, adding a parental control profile, manipulating climate settings, and limiting speed to 40 km/h as part of a harassment campaign. The case shows how legitimate connected-car features and account access can be weaponized for domestic abuse without any software vulnerability being exploited. It points to gaps in account ownership transfer, secondary user permissions, and abuse reporting for vehicle telematics platforms.
Tesla's autonomous Cybercab vehicles have begun testing robotaxi technology on Detroit-area roads, joining Waymo in the region's driverless ride-hailing race. The testing leverages Michigan's automotive expertise and infrastructure to refine self-driving systems. It marks another step in Tesla's robotaxi expansion and intensifies competition with Waymo in a key US automotive market.
A Korean consumer group is requesting an investigation into Tesla for selling a 9-million-won Full Self-Driving package on Shanghai-built cars that legally cannot use the feature in Korea. The complaint raises regulatory and consumer protection questions about how Tesla markets FSD across markets with differing approval status.
Affected Vehicle Make & Model
Tesla
Global Automotive Cyber Incidents/Eventsinformational
Bosch unveiled a new generation of its Central Gateway at EICMA Milan, a control unit that filters all traffic entering the electronics of a connected motorcycle. It ships in 16, 39 and 99-pin variants and arrives ahead of mandatory cybersecurity requirements for new motorcycle models from 11 December 2027. The gateway targets the growing attack surface of connected bikes, where telematics and TFT displays expose CAN networks to remote threats. Manufacturers will need compliant filtering hardware to meet the regulatory deadline.
India's road transport ministry proposed cybersecurity rules that would make malware protection and cyberattack resilience mandatory for certain categories of smart and connected vehicles. The rules target the growing attack surface created by autonomous driving features and always-on connectivity, with implications for both road safety and personal data privacy. If enacted, they would impose security requirements on vehicle categories sold in one of the world's largest automotive markets. The proposal signals a regulatory shift toward mandatory rather than voluntary vehicle cybersecurity controls.
Jaguar Land Rover resumed phased manufacturing in October 2025 after a cyber incident in late August or early September halted production, restarting first at its Electric Propulsion Manufacturing Centre and Battery Assembly Centre in the West Midlands. The company also arranged a new financing solution to support cashflow for qualifying suppliers affected by the shutdown. The event illustrates the extended operational and supply-chain impact of ransomware-class attacks on OEMs, with recovery measured in weeks rather than days.
In late October 2026, owners of a popular Chinese EV model reported screens going dark, climate controls failing and vehicles refusing to start, followed by ransomware demands to restore access, marking a second strike on the same EV maker after a 2025 attack. Ransomware accounted for 44 percent of the 494 publicly reported automotive and smart mobility incidents in 2025, more than double 2024 volume, according to Upstream's 2026 Global Automotive Cybersecurity Report. The trend shows ransomware increasingly targeting vehicle dashboards and operational systems rather than just backend servers.
Observed MITRE ATT&CK techniques
T1078 Valid AccountsT1486 Data Encrypted for ImpactT1531 Account Access Removal
XPeng received approval for L4 autonomous driving demonstration operations across all of Guangzhou for its Youyou Robotaxi service. The license moves XPeng from technical validation to real-world operational and business model testing, laying groundwork for commercial robotaxi deployment and export of its integrated autonomous driving solutions to global partners.
India amended AIS-156-2020 to mandate cybersecurity testing of electric vehicle battery management systems, targeting wireless interfaces such as Bluetooth that could allow unauthorized devices to discover, connect to, and manipulate safety-critical BMS functions. The framework requires OEMs to demonstrate that unauthorized mobile applications or devices cannot access the BMS. The mandate raises the compliance bar for EV makers selling in India and treats battery management as a safety-critical attack surface rather than a convenience feature. Manufacturers must now build and evidence BMS access controls ahead of certification.