China’s EV Door Recall, Plus 4 Tech Stories
China’s record EV recall is about something far less glamorous than batteries or self-driving software: getting out of the car when the electrical system is dead.
And that isn’t the only fallback worth looking at this morning. Kaltura has two unpatched server vulnerabilities, CISA put two security operations centers through roughly the same attack and got very different defensive results, the UN and Red Cross are renewing their push for rules on autonomous weapons, and WhatsApp is making account takeover a little harder.
China’s record EV recall is really about getting out when the power is gone
Nine automakers are recalling about 4.3 million vehicles in China over emergency door-release designs that can be difficult to identify or operate after a crash. That includes nearly 3 million Teslas, plus vehicles from Xiaomi, Leapmotor, Xpeng, Geely and others. The fixes vary by model, but many involve clearer labels around mechanical releases and over-the-air software changes that lower windows or adjust unlocking behavior after a serious collision.
The distinction matters. China is not recalling 4.3 million cars because the doors randomly stop working in normal use. The concern is the ugly edge case: a crash knocks out low-voltage power, the electronic release stops helping, and the person inside — or the rescuer outside — has to find a mechanical backup quickly.
That is exactly when clever industrial design stops being clever if nobody can figure out how to use it.
Electronic and flush-mounted handles have spread because they look clean, reduce drag, and let automakers do things that ordinary mechanical handles cannot. They also create another dependency on power and another interface a panicked person has to understand. China’s market regulator says several recalled models have emergency mechanical releases that blend into the interior or are otherwise difficult to recognize. Earlier this year, China also moved to ban exterior electronic handles that lack a traditional mechanical mechanism starting in 2027.
Reuters notes that U.S. regulators and courts are wrestling with similar questions, including complaints and lawsuits involving people allegedly unable to escape Teslas after crashes. That does not mean every flush handle is a death trap. It does mean “the software can open the door” is not the same safety property as “a human can open the door when the software, battery, wiring, and cabin are having the worst day of their lives.”
For owners outside China, there is no new global recall to act on this morning. But I would learn where the mechanical release is in any vehicle that normally uses an electronic button or handle. Do it before you need it. That is a five-minute piece of knowledge with a very unpleasant use case.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
Kaltura has two server flaws with no vendor patch yet
CERT/CC disclosed two vulnerabilities Tuesday in Kaltura’s HTML5 video-player library that can let an unauthenticated remote attacker read files from the server and, under common configurations, execute code.
The root problem is PHP deserialization. Kaltura’s mwEmbedLoader.php endpoint accepts a user-controlled ServiceUrl, fetches data from that location, and passes the response into PHP’s unserialize() function without adequately validating where it came from or what it contains. CVE-2026-19913 can abuse that behavior with a file:// URL to read local files, including things such as database credentials and API keys.
CVE-2026-19912 adds a path-traversal problem in the uiconf_id parameter. With the default file-based cache, an attacker can steer a malicious serialized object into a web-accessible directory and turn the flaw into remote code execution.
No login is required.
CERT/CC says affected releases include html5lib 2.103 and earlier, along with other 2.x versions that expose the vulnerable endpoint. More concerning, it says the endpoint is also exposed on Kaltura’s shared multi-tenant CDN infrastructure, so this is not limited to somebody who installed an old video server in a closet and forgot about it.
CERT/CC says it could not reach Kaltura for coordination and had not received a vendor statement when the advisory was published. Until there is a patch, its advice is to restrict or disable external access to mwEmbedLoader.php and strictly allow-list legitimate ServiceUrl destinations.
If you run Kaltura yourself, this deserves attention now. If Kaltura hosts the service for you, I would still ask what mitigation has been applied to your tenant. “It’s SaaS, so somebody else patches it” is normally a nice feature. It is less comforting when the public advisory specifically says the shared infrastructure is affected and the vendor has not responded.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
CISA tested two organizations. The tools were not the biggest difference.
CISA published a red-team report Tuesday that is worth more than another list of scary vulnerabilities because it shows what happens after somebody gets in.
The agency ran similar simulated attacks against two critical-infrastructure organizations. At both, the red team eventually demonstrated domain-level compromise and access to sensitive systems and cloud resources. The important difference is how the defenders behaved.
At Organization A, the team started with a web application that still had default credentials, used it to send convincing internal phishing messages, then found familiar enterprise weaknesses: permissive Active Directory settings, misconfigured Active Directory Certificate Services templates, clear-text credentials, long-lived AWS keys, and overly broad Microsoft Entra application permissions. The security team did not effectively detect or contain the movement. CISA says the red team was eventually reading SOC staff email and Teams messages while the defenders still did not understand the scope of the compromise.
Organization B detected the initial intrusion quickly, isolated affected systems, and forced CISA to continue the exercise under an “assume breach” model — essentially giving the testers a foothold so they could keep evaluating what would happen next. Defenders later detected activity again around an operational-technology DMZ and isolated that system too.
That nuance is important. Both assessments found weaknesses. Only one organization let the simulated attacker move through them quietly.
CISA’s big lessons are wonderfully unsexy: tune detection systems so the useful alerts are not buried in noise, give defenders the authority and procedures to act quickly, treat cloud identities and tokens as seriously as local administrator accounts, and stop leaving credentials and permissions around indefinitely because they are convenient.
Security products matter. So does whether anybody can hear the alarm, understand what it means, and shut the door before the attacker walks through the next room.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
The UN and Red Cross want binding rules before autonomous weapons cross another line
The United Nations and International Committee of the Red Cross renewed their call Tuesday for legally binding international rules governing autonomous weapons — systems that can select targets and apply force with diminishing human involvement.
This is not a new treaty, and it is not evidence that fully autonomous machines are currently choosing human targets on battlefields. The UN itself describes reports of fully autonomous and AI-guided drones in combat as unconfirmed. Reuters says autonomous systems are already used for some defensive tasks, such as anti-missile systems aboard warships, but they are not known to have autonomously targeted people.
The warning is about where the technology is heading.
UN Secretary-General António Guterres and ICRC President Mirjana Spoljaric say states are getting dangerously close to allowing machines to make the targeting decision against humans. They want negotiations on a binding instrument with specific prohibitions and restrictions to begin around the major Geneva review conference in November.
There is not international agreement on that approach. The United States and Russia, among others, have argued that existing international humanitarian law is sufficient.
I think the difficult part here is not deciding whether computers can sometimes aim more accurately than humans. Of course they can. The question is who remains responsible for deciding that a person is a lawful target, understanding the context around that person, and stopping the attack when the data or situation changes. “The model decided” is not an accountability system.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
WhatsApp is finally giving its two-step verification a real password
WhatsApp announced a small security upgrade Tuesday that is useful precisely because it is not complicated.
Its optional two-step verification has historically used a six-digit PIN as the extra secret protecting an account after someone obtains the one-time registration code. WhatsApp is now allowing a longer alphanumeric password, including special characters. That makes a guessable PIN considerably less attractive as the last line of defense against account takeover.
The company is also allowing more than one passkey on an account, useful for people who use both iOS and Android. WhatsApp says more than one billion users have already configured at least one passkey. On Android, calls from people outside your contacts will also show more context, including the caller’s country and whether you share groups.
If these options have reached your account, I would use the passkey and replace a weak six-digit verification PIN with a strong password. The best security feature is usually the one that makes the safer choice easier than the old one.
There is a common thread in today’s stories, although I did not set out looking for one. A car door, a video platform, an enterprise network, a weapon system, and a messaging account all depend on fallback controls when the normal path fails or is abused.
The fallback only helps if it is understandable, reachable, and actually works.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
China EV door recall
- Reuters: China flexes its auto-safety chops with huge recall of Tesla, other cars
- China State Administration for Market Regulation: recall summary for nine automakers
Kaltura vulnerabilities
CISA red-team assessments
Autonomous weapons
- ICRC / United Nations: Renewed call to adopt rules on autonomous weapon systems
- Reuters: UN and Red Cross call for urgent rules on autonomous weapons
