Understand the threat. Build the defense.
MAG212 explains the attacks and vulnerabilities that matter in plain language, then shows you what to do about them. Every analysis cites its sources and ends with practical steps you can take today, whether you protect a family, a small business or an enterprise network.
Latest analysis
New explainers on the vulnerabilities and incidents security teams are dealing with right now: what happened, who is affected and what to do.
Inside the GitLab Flaw: From CI Configuration to Server Execution (CVE-2026-97229)
CVE-2026-97229, a CVSS 10.0 flaw in GitLab’s regex compiler, is now in CISA’s KEV catalog. Who is exposed, which version to patch to now, how the attack works and how to hunt for prior…
Read the analysis
Tailscale SSH Vulnerabilities TS-2026-014 to 017 (“Tailworm”): What Was Fixed in v1.104.4 and How to Harden
Tailscale fixed four SSH and Serve vulnerabilities, TS-2026-014 to TS-2026-017, in v1.104.4 after a researcher’s “Tailworm”…
PolyShell (CVE-2026-48356): Why Patched Magento Stores Still Run a Hidden JavaScript Loader
PolyShell (CVE-2026-48356) let attackers upload web shells to Magento and Adobe Commerce stores. Sansec now tracks a loader…
CVE-2026-101767: Oracle E-Business Suite Flaw Lets One HTTP Request Reach the Database and the Host
CVE-2026-101767 (CVSS 9.8) lets unauthenticated attackers reach Oracle E-Business Suite’s database as APPS through the…
CVE-2026-111497: The Node.js Brotli Flaw in CISA KEV, Explained, With Fixed Versions and Checks
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js 22, 24 and 26. CISA added it to KEV on…
SkyW4lker Device-Code Phishing: How It Hijacks Microsoft 365 Accounts and How to Stop It
SkyW4lker is a Microsoft 365 phishing kit that abuses OAuth device-code sign-in: victims log in on Microsoft’s real page, pass…
LiteLLM Supply-Chain Attack: How Hackers Turned a Trusted AI Package into a Credential-Stealing Backdoor
Verify What Is Deployed: Ivanti, a Poisoned Extension, AD CS & SysGoRAT: MAG212 CYBER Technical Edition, 2 November 2026
Nine investigations rebuilt for responders: the Ivanti Connect Secure chain, a tampered Cursor extension, help-desk impersonation reaching AD CS, SysGoRAT on Linux, and five more, with PowerShell, Bash, KQL and Sigma you can adapt today.
Each issue pairs every story with a defensive field guide: an architecture diagram, the controls that actually help and the steps to verify you are protected.
Free security tools
Practical tools built for everyday security decisions. They run in your browser, and the sensitive ones never send your data anywhere.
Learn cybersecurity step by step
Structured learning paths that take you from the basics to professional skills, using our articles, cheat sheets and tools along the way.
Pick the path that fits you, from staying safe online to professional security skills, and track your progress as you go.
Start a learning path →About MAG212
MAG212 is an independent cybersecurity publication founded and edited by El Mostafa Ouchen, an IT and cybersecurity professional with more than 20 years of experience in enterprise networking, systems administration and digital infrastructure.
Every story is checked against primary sources, which we link so you can verify them yourself. The goal is defense: helping readers understand threats and protect what matters.
About us · Editorial policy · Books by the editor