Exploits, Tools & Data Recovery · How Bugs Become Attacks · Lesson 3 of 5

Reading Security Bulletins

Read Android and Apple security notes, spot exploited bugs, and check your patch level.

Triage a bulletin

A security bulletin is the vendor's public list of what an update fixed. Reading one well is a core skill in security, and it's quicker than it looks.

Google publishes the Android Security Bulletin on source.android.com, normally on the first Monday of each month. It opens with a short summary of the most severe issue, then lists fixes in tables grouped by component: Framework, System, the kernel, and parts supplied by chip makers such as Qualcomm and MediaTek. Each row has:

• The CVE ID.
• References, Google's internal bug numbers. Partner bugs carry prefixes, such as QC- for Qualcomm.
• The Type: RCE (remote code execution), EoP (elevation of privilege, gaining more power than you should have), ID (information disclosure) or DoS (denial of service, crashing something).
• The Severity, on Android's own scale.
• The affected Android versions.

The most important line is easy to miss. When Google has evidence of real attacks, the bulletin says so near the top. The September 2025 bulletin, for example, said: "There are indications that the following may be under limited, targeted exploitation," and named two flaws, one in the kernel and one in the Android Runtime. Both were rated High, not Critical.

Limited, targeted means attacks were seen against a small number of chosen people (often journalists, activists or officials, as in the spyware cases from Mobile Malware), not spread widely. That makes it less likely to hit you personally. It still means a working exploit exists, and attacks often widen once a patch is public.

Ranking a bulletin comes down to two questions. What could this flaw do? That's severity. Is anyone using it yet? That's the exploitation note. Then remember that the fix for every row is the same: install the update.

On the simulated phone, tap each entry in the October 2026 bulletin. Decide which one you would treat as most urgent.

Apple's notes and your patch level

Apple does this differently. Its Apple security releases page lists every update, newest first, in three columns: the update's name, the devices it's available for, and the release date. Apple says it doesn't disclose, discuss or confirm security issues until it has investigated and fixes are available.

Open an update's notes and you get one entry per fixed flaw:

• The component, such as Kernel or WebKit (the engine behind Safari and web pages shown inside apps).
• Available for: which devices get the fix.
• Impact: one plain sentence on what an attacker could do.
• Description: a short note on how it was fixed, such as "improved checks."
• The CVE ID and who reported it.

Apple doesn't print Critical or High labels. Watch for its exploitation wording instead. In iOS 18.3.2 (March 2025), the only entry, a WebKit flaw, said "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals." That's Apple's version of Google's "limited, targeted" note, and it's the signal to update today.

How do you know your phone has the fixes? On Android, look at the security patch level, a date. On most phones it's in Settings, About phone, Android version, under Android security update. Menu names vary a little by brand.

Many Android bulletins define two levels, such as 2025-09-01 and 2025-09-05. The -01 level covers one set of that month's fixes, and the -05 level covers everything in the bulletin. Google says the split gives phone makers flexibility to ship some fixes sooner. Each level also includes all earlier months.

On iPhone there's no patch date. Check the version in Settings, General, About, and compare it with the security releases page.

A phone a few weeks behind is normal. One many months behind is missing every fix in between.