Exploits, Tools & Data Recovery · How Bugs Become Attacks · Lesson 5 of 5

Challenge: The Bulletin Briefing

Brief a small office on this month's phone security updates and what to do first.

What leads the briefing

You've just joined the IT help desk at a small accounting firm with 30 staff phones: a mix of Pixels, Samsung Galaxy phones and iPhones. Your manager, Dana, asks you to read this month's updates and brief the team on Friday.

The November 2026 Android bulletin has three entries you flag:

• CVE-2026-20514, Media framework, Critical, RCE.
• CVE-2026-20533, Kernel, High, EoP. The summary says there are indications it may be under limited, targeted exploitation.
• CVE-2026-20560, Framework, Moderate, ID.

Dana also forwards a vendor newsletter that ranks the media framework bug first "because it has the highest rating." She asks what your briefing should lead with, and why.

Staff mostly use their phones for email, client spreadsheets and the firm's banking app. Nobody has reported anything unusual, and you have no sign that the firm itself has been attacked.

A second source

Dana likes the answer but wants an outside source for the firm's patching policy. "Our cyber insurer keeps asking whether we track bugs that are actually being exploited, not just ones with high scores. Is there a public list, run by the US government, that only includes flaws with a CVE ID, reliable evidence of real attacks and a known fix?"

She wants its short name for the policy document.

The hand-me-down phone

You check the staff phones. The Pixels already show an Android security update of 2026-11-05. The Galaxy phones show 2026-10-01, and their update screens say a new update is rolling out. One older Android phone, a model from 2019, shows 2024-03-05, and its update screen says the software is up to date.

Dana asks about that one: "It says it's up to date, so it's fine, right?"

Can the iPhones wait

For the iPhones, Dana reads Apple's notes for the latest iOS update. One WebKit entry says Apple is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

A coworker shrugs: "Nobody targets accountants. We can wait until next quarter." You point out that the attacks started before Apple had a fix. Now the fix is public, and anyone can study it to find the flaw.