Safety Controllers Lag Behind Vehicle Security Updates
Many safety-critical vehicle controllers cannot receive remote security updates, leaving some braking, steering and driver-assistance flaws open until a workshop visit.
Updated on Nov. 5, 2026 in Auto Parts
Live Poll
Would you feel safe driving a car that needs a workshop visit for safety software fixes?
The eSync Alliance has warned that many safety-critical vehicle controllers cannot receive remote security updates. Vulnerabilities affecting braking, steering or driver-assistance systems may remain unresolved until owners take their vehicles to a workshop.
Why it matters
Manufacturer over-the-air update systems were originally designed around infotainment and telematics, while braking, steering and driver-assistance controllers usually come from separate specialist suppliers. That fragmentation leaves a gap between software that can be patched remotely and systems that govern vehicle safety.
A QNX survey of 1,100 embedded automotive software developers informed the warning. The PerfektBlue flaws in OpenSynergy's BlueSDK were demonstrated on infotainment systems used by Volkswagen, Mercedes-Benz and Skoda, but the number of affected vehicles still awaiting the fix is unknown.
The players
eSync Alliance
An industry group promoting a common over-the-air data pipeline for distributing software updates and receiving diagnostic information from vehicles.
PCA Cyber Security
A cybersecurity firm that demonstrated the PerfektBlue vulnerabilities on infotainment systems used by several major carmakers.
OpenSynergy
A software company whose BlueSDK Bluetooth software contained the PerfektBlue vulnerabilities and which issued patches to its customers.
The details
Many braking, steering and driver-assistance controllers are updated only at a service, or not at all. OpenSynergy made patches for the PerfektBlue flaws available to customers in September 2024, but PCA Cyber Security said in June 2025 that not every affected manufacturer had received the patch through its supply chain.
Timeline
September 2024: OpenSynergy made PerfektBlue patches available to its customers.
June 2025: PCA said not all affected manufacturers had received the patch.
Within the next three years: connected vehicles could become a major cyberattack target.
Roadmap
The PerfektBlue disclosure showed that Bluetooth flaws in infotainment software could reach vehicles across several major brands. The eSync warning extends that concern to braking, steering and driver-assistance controllers, which the update systems of most carmakers were not built to reach.
Owners of connected vehicles should ask their dealer or workshop whether safety-related controllers have received the latest security patches. Until those updates are confirmed, keep software current on any connected infotainment or Bluetooth accessories where the manufacturer provides them.
The takeaway
Vehicle security now depends on software that many safety controllers cannot receive remotely, so buyers should check patch status at service visits. Carmakers and suppliers will need a shared update path before those gaps close.
Further reading
Explore more in Auto Parts coverage on how component suppliers shape vehicle software security.
Source note: This article includes information reported by AutomotiveManagement.
Live Poll
Would you feel safe driving a car that needs a workshop visit for safety software fixes?
