The job seemed straightforward: A client wanted the cybersecurity company Core Security Technologies to probe for vulnerabilities in a new system to let customers use its Wi-Fi network.

But the client was an airline, and Core Security found a big and potentially dangerous hole. The network was so vulnerable to being hacked that a terrorist could use it to remotely detonate a bomb, much like a cellphone is sometimes used by militants as a timing device on explosives.