The team built what they describe as a full software-defined-radio ground station implementation capable of injecting fake CPDLC flight instructions and carrying out denial-of-service attacks against the system. To validate the work, they partnered with air navigation service providers and an avionics manufacturer to construct a fully functional test environment using certifiable hardware, rather than relying on simulation alone. Using that setup, they demonstrated that even an isolated rogue ground station could pose a substantial threat, particularly in scenarios where pilots are managing a high workload or operating with degraded communication options.

This is not the first time CPDLC has drawn scrutiny. The same research group has published prior work on CPDLC’s threat model going back several years, and the broader pattern extends to the closely related ACARS messaging system, both designed during an era when the wireless spectrum itself functioned as the primary access control. If you could not physically transmit on the right frequency, you could not participate in the conversation. Widely available software-defined radios have quietly erased that barrier, and the underlying protocols were never updated to compensate.

What distinguishes this year’s paper is the emphasis on a validated, full-stack demonstration against real, certifiable avionics hardware in a live CPDLC test environment, developed in direct collaboration with industry partners, rather than a purely theoretical protocol analysis. That collaborative approach mirrors how the same research group previewed elements of this work at DEF CON’s Aerospace Village the week prior, a venue built specifically to bridge the gap between the security research community and the aviation industry so that findings like this one reach manufacturers, airlines, and regulators through a structured process rather than surfacing as an unexpected headline.

It is important to be precise about what this research does and does not show. There is no indication that this vulnerability has been exploited outside of a controlled research environment, and CPDLC is typically used alongside voice communication as a backup, not as the sole channel for critical instructions in every phase of flight. Aviation’s layered safety culture, including pilot judgment, cross-checking, and procedural redundancy, is specifically designed to catch anomalies before they become incidents. Still, a protocol with no cryptographic authentication sitting inside a safety-critical communication chain is precisely the kind of structural gap that aviation cybersecurity research exists to surface before it becomes an operational problem rather than a paper.

The broader pattern here is a familiar one across aviation systems built decades before cybersecurity was treated as a design requirement. ADS-B surveillance data, ACARS messaging, and now CPDLC have all faced similar research findings: functional, reliable systems built on an assumption of good faith that no longer holds now that the tools needed to interact with them are cheap and widely available. Retrofitting authentication and encryption into decades-old, globally standardized aviation protocols is neither quick nor simple, but peer-reviewed findings like this one are exactly the kind of evidence that gives regulators, standards bodies, and manufacturers the justification to prioritize the work.

For aviation cybersecurity teams, the value of this kind of public, peer-reviewed research is that it happens in the open, developed alongside the manufacturers and service providers whose systems are involved, rather than being discovered independently by someone with less benign intentions. Legacy aviation communication protocols were built for a world without cheap software-defined radios, and closing that gap will require sustained collaboration between researchers, manufacturers, and regulators rather than a single patch or policy update.

Source: USENIX Security Symposium ‘26 - Sliding into the Flight Deck’s DMs: Practical Message Attacks on CPDLC
https://www.usenix.org/conference/usenixsecurity26/presentation/ziazi

The target is a communications standard called ARINC 429, a decades-old data bus technology that carries information between key avionics components using electrical current across a pair of wires. It was designed in the 1970s for reliability and predictable behavior, not for a hostile environment where an unauthorized device might try to join the conversation. The bus does not authenticate the origin of messages or cryptographically verify that a command came from a legitimate source. That design has been dependable for decades under normal conditions, but it creates a structural weakness if an attacker can physically connect to the wiring.

The research team built a device that acts as a third party on the bus, overriding legitimate transmissions by driving more electrical current than the genuine equipment. Using a testbed built from real Boeing 737 components, they showed the implant could sit between the flight-management computer and the cockpit display unit, intercepting and replacing messages while suppressing any indication that the data had changed. In their proof-of-concept demonstration, the team showed the technique could be used to alter flight-plan information or manipulate data related to weight, balance, and temperature, values that feed directly into takeoff calculations.

It is important to be precise about the conditions this requires. The attack depends on physical access to a maintenance connector, meaningful advance engineering and planning, and a device built specifically for this purpose. The researchers did not demonstrate the technique on a live, in-service aircraft, and pilots retain the ability to override manipulated instructions, provided they detect that something has changed. The team also disclosed the vulnerability to Boeing well before publication and validated their findings further in Boeing’s own lab, a responsible disclosure process that reflects how this kind of research is meant to work.

What makes the finding significant is not that it represents an imminent, easily executed threat, but that it reframes what counts as an aviation cybersecurity concern in the first place. Physical access to an aircraft has traditionally been treated as a safety and security matter handled through access control, badging, and maintenance procedures, not as a cybersecurity risk requiring the same threat modeling applied to networked systems. This research argues that boundary no longer holds. A maintenance port that is externally reachable, even briefly, is functionally an attack surface, and the industry’s existing physical security controls were not built with that framing in mind.

The 737 is one of the most widely flown commercial aircraft in the world, with thousands in active service, which raises the stakes of any structural finding involving its core avionics architecture, even one requiring the specific conditions this attack does. ARINC 429 is not unique to the 737 either; variations of the same bus technology are used broadly across commercial aviation, meaning the underlying design pattern, not just this one aircraft type, is what deserves attention.

For aviation security teams, the practical response is less about panic and more about updated threat modeling. Maintenance ports, wiring access points, and other physical interfaces to avionics systems warrant the same kind of risk assessment already applied to network endpoints, which means understanding exactly where these access points exist across a fleet, who can reach them and under what circumstances, and whether monitoring exists to detect anomalous behavior on buses that were never designed to expect it. Aviation cybersecurity cannot stop at the edge of the network, and closing this gap requires treating brief physical access with the same seriousness as a remote intrusion attempt.

Source: USENIX Security Symposium ‘26 / UC San Diego - Researchers Use a Physical Device to Take Over Electronics in a Boeing 737
https://today.ucsd.edu/story/researchers-use-a-physical-device-to-take-over-electronics-in-a-boeing-737

So we tried it, and not on some tablet we set up ourselves, but on a real airline-issued Electronic Flight Bag in a line pilot’s hands, loaded with the briefing for an actual scheduled flight. Next to it on the table we put a phone that cost fifty dollars.

It took seconds. Then the tablet put a message up on screen for the crew, in its own words, about what it had just lost. What that message said, and what we did to the tablet afterwards, is in the full article.

The flight bag wasn’t the only thing we did from that one seat. We took an entire network offline and held it there. We filled the air with networks that don’t exist, carrying names a passenger would expect to see, until picking out the real one became impossible, and we got a device to join us instead of the network it thought it was joining. What we could see from the moment it did is the part an airline should be worried about.

Then there are the headphones, which are their own chapter. Wireless earbuds are built to trust a phone that comes near them, and a flaw in the way that trust works means a great many of them will accept almost any phone, not just their owner’s. What somebody can do to you once they’re inside your headphones goes a long way past playing loud noises at you.

Here’s the part that should stop you. All of that came off an LG Nexus 5, a phone from 2013. It costs about fifty dollars today, looks like something that’s been sitting in a drawer for a decade, and it goes through airport security in a pocket every single time, because nobody looks at a phone and sees a weapon. Security will take your nail scissors away and won’t allow a badminton racquet into the cabin, and this walks straight through.

What makes it possible is that the radios inside a phone were never limited to the job they were sold for. The Wi-Fi and Bluetooth chips in your pocket are capable of reaching the people sitting around you instead of your music. On the ground that’s a risk you can walk away from, but at 35,000 feet there are a few hundred people sitting shoulder to shoulder for hours sharing the same airwaves, and not one of them can step out of range.

None of this even has to work for a flight to suffer, which is the strangest part of all. In January, a passenger named his hotspot “I have a bomb”; a crew member spotted it, and an A321 carrying 148 people declared an emergency, was met by a NATO fighter escort, and was searched in Barcelona. In May, a Bluetooth device called “BOMB” turned a United flight back over the Atlantic, and it belonged to a teenager.

Both of those were jokes. Somebody typed a word and hundreds of people paid for it. The article is about what that same seat looks like when the person sitting in it actually knows what he’s doing.

Read the full article: https://cyviation.aero/a-weapon-that-clears-security/

That does not make the aircraft irrelevant, Almog argued. The cinematic version of aircraft hacking, someone seizing flight controls mid-flight, deserves the skepticism it gets. The more realistic exposure is duller and more persistent: aircraft continuously consume data from the ground, including navigation databases, performance data, electronic flight bag content, and loadable software. In that sense, the aircraft functions as the endpoint of a supply chain that few organizations actively monitor.

One theme Almog returned to repeatedly was how differently aviation risk behaves compared to a typical enterprise environment. GNSS jamming and spoofing, he noted, produce no packets, no endpoint alerts, and nothing that shows up in a SIEM, which makes it invisible to security operations approaches built around network telemetry. The interference has become routine across the Eastern Mediterranean, Black Sea, and Persian Gulf, with crews reporting false position fixes and degraded inertial systems, and the first indication is often a pilot’s written report rather than any automated detection.

The interview also detailed a vulnerability CYVIATION’s own research team disclosed earlier this year. In April, the company identified a flaw tracked as CVE-2026-1579 in PX4 Autopilot, flight-control software running on a large installed base of drones and unmanned aircraft. The Cybersecurity and Infrastructure Security Agency issued a corresponding advisory, ICSA-26-090-02, with a severity score of 9.8 out of 10. The underlying issue was that MAVLink message signing ships disabled by default, meaning the command channel accepts unsigned instructions and an attacker positioned on the network could potentially direct the aircraft. Almog described it as a case where a safety-critical channel simply never authenticated anyone, rather than a system that had to be tricked or bypassed. The company has said it is extending this line of research to additional flight control platforms.

On the electronic flight bag specifically, Almog characterized it as underrated primarily as a symptom rather than a root cause. The real exposure, he argued, sits in the broader data loading chain that also delivers loadable software parts to aircraft, and in most operators’ inability to verify the integrity and provenance of what gets loaded, or reconstruct what happened afterward. Because aircraft cannot be penetration tested the way an enterprise network can without risking airworthiness, Almog pointed to digital twin modeling as a way to test loadable content against hostile input, or replay an event to determine whether an anomaly was cyber-related or a mechanical fault, without touching the airframe itself.

Asked how a smaller carrier with limited security staff should prioritize, Almog suggested starting with an inventory of what software runs across the fleet and what feeds it, then focusing ground-side effort on access control and tested backup recovery, since that is where breaches most often originate, before addressing aircraft-level visibility, which he suggested most small operators are better served buying than building given how scarce the relevant expertise is.

Takeaway: As aviation cybersecurity conversations continue to weigh dramatic in-flight scenarios against everyday ground-system risk, understanding where losses actually occur, and building visibility into the data flowing between ground and aircraft, remains the more practical starting point for operators of any size.

Source: Help Net Security - Aviation cyber risk sits on the ground, the blindness sits in the air

https://www.helpnetsecurity.com/2026/07/31/eliran-almong-cyviation-aviation-cyber-risk/

Rather than relying solely on traditional satellite navigation, aircraft manufacturers and technology providers are exploring multiple layers of protection. These include alternative positioning technologies, advanced inertial navigation systems that continue operating when GPS signals are disrupted, and enhanced multi-sensor navigation solutions that combine data from several independent sources. Together, these technologies help reduce reliance on a single navigation input and improve operational continuity during interference events.

The growing investment in resilient navigation reflects a broader shift across aviation. As electronic interference becomes more common in several regions of the world, operators are placing greater emphasis on redundancy, situational awareness, and the ability to detect and respond to anomalous navigation data before it affects flight operations. Improving resilience is no longer only about preventing interference, but also ensuring aircraft can continue operating safely when disruptions occur.

For the aviation industry, strengthening navigation resilience will require a combination of new technology, operational procedures, crew training, and continuous threat intelligence. As GPS interference continues to evolve, layered navigation capabilities and aircraft-level cyber visibility will play an increasingly important role in supporting safe, reliable, and resilient operations.

Source: National Business Aviation Association (NBAA). 3 Emerging Technologies to Outsmart Aircraft GPS Spoofing/Jamming

https://nbaa.org/news/business-aviation-insider/2026-07/3-emerging-technologies-to-outsmart-aircraft-gps-spoofing-jamming/

AI systems create unique security challenges that extend beyond conventional cybersecurity. Organizations must address risks such as prompt injection attacks, unauthorized access to sensitive information, model manipulation, insecure third-party AI integrations, and the growing use of unsanctioned “shadow AI” applications by employees. Without proper oversight, these risks can expose confidential data, weaken security controls, and create new attack pathways.

The article emphasizes that effective AI security begins with governance. Organizations should establish clear policies for AI usage, understand where AI is being deployed, evaluate third-party AI providers, continuously monitor AI systems, and educate employees on responsible use. Security teams should also incorporate AI into existing risk management and incident response processes rather than treating it as a standalone technology.

For the aviation industry, AI is expected to play an increasing role in operations, maintenance, cybersecurity, and decision support. As adoption accelerates, organizations will need to balance innovation with resilience by ensuring AI systems are secure, transparent, and properly governed. Building AI security into existing cybersecurity strategies today will help reduce future risk while supporting safe and reliable digital transformation across aviation.

Source: Security Boulevard. AI Security in 2026: What Organizations Need to Do

https://securityboulevard.com/2026/07/ai-security-in-2026-what-organizations-need-to-do/

Modern IFEC platforms extend well beyond traditional seatback entertainment. Wireless streaming, high-speed satellite connectivity, cloud-based content delivery, and integration with passengers’ personal devices are becoming standard features across commercial aviation. As these systems become more interconnected, they also increase the number of digital assets that must be managed and protected throughout an aircraft’s lifecycle.

The continued expansion of connected cabin technologies reinforces the importance of cybersecurity alongside passenger experience. Every connected interface, onboard application, and communication pathway introduces additional considerations for system integrity, data protection, and operational resilience. As airlines modernize their fleets, maintaining visibility into these increasingly complex digital environments will become an essential component of aviation cybersecurity.

For the aviation industry, the evolution of IFEC reflects a broader shift toward fully connected aircraft. Passenger experience, operational efficiency, and cybersecurity are becoming increasingly interconnected, requiring organizations to balance innovation with resilience. As digital transformation accelerates, understanding and managing cyber exposure across connected aircraft systems will remain a critical priority for operators and manufacturers alike.

Source: IndexBox. Austria In-Flight Entertainment Systems Market Analysis, Forecast, Size, Trends and Insights

https://www.indexbox.io/store/austria-inflight-entertainment-systems-market-analysis-forecast-size-trends-and-insights/

Unlike conventional IT penetration testing, OT assessments must account for systems that support critical operations where safety and availability are the highest priorities. These environments often include industrial control systems, automation platforms, and operational technologies that cannot simply be taken offline for security testing. As a result, OT penetration testing requires specialized expertise and carefully planned methodologies that minimize operational disruption while providing meaningful insight into cyber risk.

For aviation, many operational systems are becoming increasingly interconnected through digital maintenance platforms, airport infrastructure, manufacturing environments, and other operational technologies. Understanding how these systems could be targeted allows organizations to strengthen defenses, improve resilience, and address security gaps before they affect operations. Rather than waiting for vulnerabilities to be discovered during an incident, regular assessments provide actionable information that supports long-term risk management.

As cyber threats continue to evolve, proactive validation is becoming just as important as prevention. Organizations that regularly assess the security of their operational environments are better positioned to strengthen resilience, support compliance efforts, and reduce the likelihood of operational disruption. Cybersecurity is no longer only about responding to threats. It is increasingly about understanding where risk exists before an attacker does.

Source: Quality Magazine. The Demand for Integrating Cybersecurity into Aerospace Quality
https://www.qualitymag.com/articles/99720-the-demand-for-integrating-cybersecurity-into-aerospace-quality

Modern aerospace organizations rely on connected engineering tools, digital manufacturing systems, cloud platforms, inspection technologies, and software-driven operations throughout the product lifecycle. While these technologies improve efficiency and collaboration, they also introduce new cyber risks that can directly affect product quality, operational continuity, and safety. A cybersecurity incident can compromise data integrity, disrupt production, or undermine confidence in quality assurance processes.

The article argues that cybersecurity should be viewed as part of an organization’s overall quality management strategy rather than as a separate technical function. Building cyber resilience into quality processes helps organizations strengthen supplier oversight, protect digital assets, improve traceability, and reduce operational risk across increasingly connected aerospace ecosystems. This integrated approach also supports organizations as regulatory expectations and customer requirements continue to evolve.

For the aviation industry, this shift reflects a broader movement toward lifecycle-wide risk management. Quality, cybersecurity, safety, and compliance are becoming increasingly interconnected, requiring greater collaboration across engineering, manufacturing, maintenance, and operational teams. Organizations that integrate cybersecurity into their quality culture will be better positioned to strengthen resilience while supporting long-term operational performance.

Source: Quality Magazine. The Demand for Integrating Cybersecurity into Aerospace Quality

https://www.qualitymag.com/articles/99720-the-demand-for-integrating-cybersecurity-into-aerospace-quality

The publication identifies several common areas of cyber exposure, including outdated systems, insecure network connections, third-party risks, and limited visibility across connected operational environments. Addressing these vulnerabilities requires organizations to move beyond reactive security measures and adopt a proactive approach focused on continuous risk assessment and stronger cyber governance.

The report also emphasizes practical cybersecurity best practices, including maintaining asset visibility, implementing risk-based vulnerability management, strengthening access controls, conducting regular security assessments, and improving collaboration across the aviation ecosystem. These measures can help organizations reduce cyber risk while supporting regulatory readiness and operational continuity.

As aviation systems continue to evolve, cybersecurity is becoming an essential part of maintaining safe, reliable, and resilient operations. Reports such as this reinforce the importance of understanding cyber exposure before incidents occur and building security into every stage of the aviation lifecycle.

Source: Global Aerospace | Understanding the Modern Cybersecurity Threat Landscape: Common Vulnerabilities and Aviation Cybersecurity Best Practices

https://uk.finance.yahoo.com/news/global-aerospace-provides-insights-understanding-163200305.html

The report notes that reducing unnecessary system complexity and improving information sharing are two important steps toward strengthening cyber resilience. Organizations often rely on multiple disconnected systems, making it more difficult to maintain visibility, identify vulnerabilities, and respond efficiently to emerging threats. Simplifying technology environments while increasing collaboration can help improve both operational resilience and security.

The publication also emphasizes that cybersecurity is not solely a technology challenge. Effective cyber resilience depends on communication between stakeholders, timely sharing of threat intelligence, and coordinated efforts to address risks before they impact operations. As aviation continues its digital transformation, collaboration across the ecosystem will play an increasingly important role in protecting critical infrastructure.

With cyber threats continuing to evolve alongside aviation technology, organizations are placing greater emphasis on proactive risk management, operational visibility, and cross-industry cooperation. The report reflects a broader shift toward viewing cybersecurity as an ongoing operational capability rather than a standalone IT function.

Source: Travel Daily Media | Aviation sector urged to enhance cybersecurity collaboration

https://www.traveldailymedia.com/aviation-sector-urged-to-enhance-cybersecurity-collaboration/

The vulnerability, tracked as CVE-2026-1579, received a critical severity score of 9.8 out of 10 and affects communication mechanisms used by drones and unmanned aerial vehicles operating in commercial, emergency response, defense, and research environments.

The Discovery

According to CYVIATION’s research findings, the issue stems from the lack of authentication protections on critical communication channels used between operators and aircraft.

Without proper verification mechanisms, malicious actors with access to the network may be able to transmit unauthorized commands to affected systems. This creates the potential for command manipulation, operational disruption, and loss of control over affected aircraft.

The vulnerability demonstrates how weaknesses in software architecture can create significant operational risks when deployed in real-world aviation environments.

Why It Matters

Modern aviation increasingly relies on software-defined systems and connected platforms. While these technologies improve efficiency and capability, they also expand the potential attack surface available to adversaries.

In this case, the absence of robust command authentication highlights a broader challenge facing aviation cybersecurity: ensuring that every critical instruction received by an aircraft originates from a trusted and verified source.

As autonomous and remotely operated systems become more common, communication security will continue to play a central role in aviation resilience.

Recommended Actions

Organizations operating affected PX4-based platforms should review their security configurations and implement available mitigation measures as soon as possible.

Recommended actions include:

• Enable digital signature verification and message authentication mechanisms.

• Restrict aircraft and control systems from direct exposure to public networks.

• Segment operational environments using appropriate network controls.

• Follow official hardening and security guidance issued by the PX4 development community.

• Conduct periodic reviews of communication security controls and software configurations.

Looking Ahead

This discovery reinforces the need for continuous vulnerability research across the aviation ecosystem. Cybersecurity is no longer limited to traditional IT infrastructure. Aircraft, flight control systems, ground operations, and autonomous platforms all require ongoing visibility and risk management.

As aviation systems become increasingly connected, proactive security measures will be essential to maintaining safe and resilient operations.

At CYVIATION, we continue to monitor emerging vulnerabilities affecting aviation technologies and provide intelligence designed to help operators understand, assess, and reduce cyber risk across their environments.

The aviation industry is becoming increasingly connected. Modern aircraft rely on digital systems that support communications, maintenance, operations, navigation, and passenger services. While these capabilities improve efficiency and decision making, they also create new cybersecurity considerations for operators and aviation stakeholders.

According to Aviation Today’s report, the growth of connected aircraft technology is increasing the number of digital assets and communication pathways that organizations must monitor and protect.

The Expanding Aviation Attack Surface

Aircraft no longer operate as isolated systems. Airlines, airports, maintenance providers, manufacturers, satellite communications providers, and cloud platforms are becoming increasingly interconnected.

Every new connection introduces additional cyber risk. Threat actors continue to target aviation organizations through ransomware campaigns, supply chain attacks, credential theft, and disruptions to critical operational systems.

Although many attacks focus on business networks rather than flight-critical systems, the operational impact can still be significant. Delays, service interruptions, reputational damage, and regulatory consequences can all result from cyber incidents.

Connectivity Creates New Security Challenges

The aviation sector depends on digital innovation to improve operational performance and passenger experience. However, organizations must ensure cybersecurity capabilities evolve alongside technological adoption.

Key areas requiring attention include:

• Asset visibility

• Vulnerability management

• Aviation-focused threat intelligence

• Supply chain risk assessment

• Regulatory compliance

• GNSS and navigation system monitoring

Without visibility into connected assets and their associated risks, organizations may struggle to identify vulnerabilities before they can be exploited.

Cybersecurity and Regulatory Expectations

Regulators increasingly view cybersecurity as an operational requirement rather than solely an information technology issue.

Frameworks such as EASA Part-IS place greater emphasis on risk management, asset visibility, incident reporting, and organizational resilience. As cybersecurity requirements continue to evolve, aviation organizations will need to demonstrate a mature approach to identifying and mitigating cyber risk.

CYVIATION Perspective

The aviation industry’s digital transformation continues to accelerate. As connectivity expands, so does the need for continuous monitoring, threat intelligence, and aircraft-level visibility.

Organizations that understand their digital environment, maintain visibility across operational assets, and proactively address emerging threats will be better positioned to maintain security, compliance, and operational continuity.

Cybersecurity is no longer only about protecting networks. It is about ensuring safe, resilient, and uninterrupted aviation operations.