Understand the threat. Build the defense.
MAG212 explains the attacks and vulnerabilities that matter in plain language, then shows you what to do about them. Every analysis cites its sources and ends with practical steps you can take today, whether you protect a family, a small business or an enterprise network.
Latest analysis
New explainers on the vulnerabilities and incidents security teams are dealing with right now: what happened, who is affected and what to do.
Barracuda ESG Exploited: Pre-Auth Bypass Plus Command Injection Chains to Root
Barracuda confirms a small number of customers were hit by a two-flaw chain on its Email Security Gateway. Which products need which patch, and how to investigate.
Read the analysis
Cold-Chain Sabotage Gets a Name: France Blames IRGC-Linked Unit as US Agencies Harden Refrigeration Controllers
France blamed an IRGC-linked unit for sabotage on more than 700 refrigeration sites as US agencies urged operators to pull…
Operation Endgame Hits Gootloader as DOJ Moves on Binance-Theft Funds and FaceStealer
Law enforcement disrupted Gootloader’s server network while DOJ targeted North Korea-linked Binance-theft funds and the…
When the Vendor’s Identity Is the Attacker: Qubole’s AWS Roles, Railway’s Build Escape and AntiFox
A compromised vendor account assumed dormant cross-account roles with valid External IDs to read customer secrets. How to hunt it…
wfx: Hijacked GitHub Accounts Turn CI Into a Secret Stealer, and bee-js Shows Provenance Is Not Safety
Hijacked GitHub accounts opened probe pull requests that stole CI secrets and planted cloud persistence, while a…
One Vendor Key, Three Breaches: How Fireworks’ Exposed Key Led to Cursor’s Backdoored Extension and Notion’s Exposure
An exposed key at AI vendor Fireworks led to a backdoored extension in Cursor’s marketplace cache and exposed Notion AI…
SSHole (CVE-2026-123158): The Narrow OpenSSH Bypass CISA Says Is Exploited
SSHole only bites when four conditions line up on musl-based systems like Alpine, but CISA lists it as exploited. How to tell if…
The Keys Were Already Inside: MAG212 CYBER Weekly, November 14, 2026
This week, attackers came in through access defenders had already granted: Check Point root, N-central’s Legacy API, Cursor’s poisoned extension, wfx CI secret theft and dormant AWS vendor roles. Plus Outlook and Chrome zero-days and 12 KEV additions.
Each issue pairs every story with a defensive field guide: an architecture diagram, the controls that actually help and the steps to verify you are protected.
Free security tools
Practical tools built for everyday security decisions. They run in your browser, and the sensitive ones never send your data anywhere.
Learn cybersecurity step by step
Structured learning paths that take you from the basics to professional skills, using our articles, cheat sheets and tools along the way.
Pick the path that fits you, from staying safe online to professional security skills, and track your progress as you go.
Start a learning path →About MAG212
MAG212 is an independent cybersecurity publication founded and edited by El Mostafa Ouchen, an IT and cybersecurity professional with more than 20 years of experience in enterprise networking, systems administration and digital infrastructure.
Every story is checked against primary sources, which we link so you can verify them yourself. The goal is defense: helping readers understand threats and protect what matters.
About us · Editorial policy · Books by the editor