Understand the threat. Build the defense.
MAG212 explains the attacks and vulnerabilities that matter in plain language, then shows you what to do about them. Every analysis cites its sources and ends with practical steps you can take today, whether you protect a family, a small business or an enterprise network.
Latest analysis
New explainers on the vulnerabilities and incidents security teams are dealing with right now: what happened, who is affected and what to do.
Drupal Commerce Core CVE-2026-118539 Is Being Exploited: Patch, Then Audit Your Orders
Drupal rates the Commerce Core access bypass CVE-2026-118539 highly critical and says it is actively exploited. Update to 3.3.13 or 8.x-2.41, then audit orders placed since late October.…
Read the analysis
Synology C3RB3R Ransomware: Which DSM Builds Are Safe and What to Do If Your NAS Is Hit
C3RB3R ransomware is encrypting Synology NAS devices on outdated DSM, renaming files .L0CK3D. Here are the minimum fixed DSM…
3AM Ransomware at a UK School Estate: Veeam Credentials, Rogue Domain Trusts and a Suspected AI Loop
Bitdefender reconstructs a 3AM ransomware intrusion at a UK school estate: Veeam credential theft, two backdoor Domain Admins,…
APT29 Watering Holes Serve n-day Exploits to Outdated iPhones and Android Phones: How to Check Your Fleet
Sekoia links a mobile watering-hole campaign to APT29: compromised and lookalike sites fingerprint visitors and serve…
cPGuard Update Channel Hijacked: What Ran on 2,950 Linux Servers and How to Rotate Every Exposed Secret
A fake cPGuard update ran as root on about 2,950 Linux hosting servers on November 2, copying password hashes, SSH keys and MySQL…
CVE-2026-119977: The WordPress Core Update Race in CISA KEV, Explained, With Fixed Versions for Every Branch
CVE-2026-119977 lets an unauthenticated attacker reach the WordPress installer during the seconds a core update runs. CISA added…
Malicious Claude Code Extension in Cursor: How to Check Your PC or Mac
A tampered Claude Code extension in Cursor’s marketplace planted an attacker SSH key that survives uninstalling. How to check…
When the Update Becomes the Attack: WordPress Core, cPGuard, APT29 Mobile & 3AM Ransomware: MAG212 CYBER Daily, 4 November 2026
CISA flags an exploited WordPress core update race, cPGuard’s update channel leaks root secrets from ~2,950 servers, APT29 targets outdated phones, and 3AM ransomware goes after school backups. Verified fixes inside.
Each issue pairs every story with a defensive field guide: an architecture diagram, the controls that actually help and the steps to verify you are protected.
Free security tools
Practical tools built for everyday security decisions. They run in your browser, and the sensitive ones never send your data anywhere.
Learn cybersecurity step by step
Structured learning paths that take you from the basics to professional skills, using our articles, cheat sheets and tools along the way.
Pick the path that fits you, from staying safe online to professional security skills, and track your progress as you go.
Start a learning path →About MAG212
MAG212 is an independent cybersecurity publication founded and edited by El Mostafa Ouchen, an IT and cybersecurity professional with more than 20 years of experience in enterprise networking, systems administration and digital infrastructure.
Every story is checked against primary sources, which we link so you can verify them yourself. The goal is defense: helping readers understand threats and protect what matters.
About us · Editorial policy · Books by the editor