Android Patch Fixes Critical RCEs; New Ransomware & Data Breaches Emerge

Critical Vulnerabilities and Exploits:

• Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death': Android's November 2026 patch addresses CVE-2026-58868, a critical heap buffer overflow in FrameDecoder.cpp enabling remote code execution without user interaction. The update also resolves two additional critical RCEs, CVE-2026-58876 and CVE-2026-58936, in the System component. Detection methods include monitoring FrameDecoder.cpp for crashes and analyzing logcat for framework errors, with remediation emphasizing immediate patching and MDM deployment.

Emerging Threats and Malware:

• New 'Has' Ransomware and 'LunexLoader' Malware Emerge: 'Has Ransomware' has been identified as a Dharma Ransomware-as-a-Service (RaaS) variant targeting SMBs through phishing and unpatched RDP services. It employs double-extortion tactics, exfiltrating data before encryption and threatening public release if ransom is not paid.

Recent Data Breaches and Incidents:

• Russian Hosting Provider Begot Hit by Destructive Data-Wiping Attack: Russian web hosting provider Begot experienced a destructive cyberattack that erased data from its cloud infrastructure after attackers gained access to management systems. The incident has impacted hundreds of websites, and recovery is complicated by the loss of binary backups.
• K-Pop Agency HYBE Discloses Breach Exposing Employee, Partner Data: HYBE, a South Korean entertainment agency, reported a data breach originating from a vulnerable third-party document preview software. The incident exposed sensitive personal information of employees and business partners, including medical records and passport details, and provided access to the company's expense management system.
• Amplifon Reports Data Breach Months After Initial Intrusion: Amplifon (USA) has disclosed a data breach that occurred between January and February 2026, with personal data confirmed to be impacted on October 6. The compromised data may include Social Security numbers or financial information for a limited number of individuals.
• DreamHost Confirms Months-Long Breach; Customer Credentials Stolen: Web hosting provider DreamHost confirmed a breach that began in August 2026 and lasted for several months, resulting in the theft of customer emails and credentials. The company is implementing mandatory password resets for some customers as its investigation continues.
• Qilin and Akira Ransomware Gangs Claim Flurry of New Victims: The Qilin and Akira ransomware gangs have claimed responsibility for multiple new data breaches on November 6, 2026. Qilin's new victims include Calvary Christian College and Insurance Audit Services, while Akira listed accounting firm David L. Wade and Associates on its leak site, indicating ongoing activity across various industries.