November 2 – November 8, 2026 – Content & Platform Updates

This week, we are back with over 20 new hands-on labs, focused around named CVEs in widely used self-hosted software, AI agent infrastructure, and a MIPS binary exploitation challenge.

What happens when a certificate authority’s private keys aren’t so private? 

Eight eMudhra intermediate certificate authorities had keys so weak they could be recovered from public certificates, potentially enabling fraudulent TLS certificates and code signing.

Our research team breaks down how a key-generation failure undermined the certificate hierarchy, what the compromise could enable, and what defenders should check.

[Explore the eMudhra Technical Analysis]

Want to put the research into practice?

The eMudhra Compromise lab lets you practice exploiting the weakness in a controlled environment. Available in the Offensive Cyber Range, exclusive to Learn Enterprise subscribers.

[Try the eMudhra Compromise Lab]

Continuous Learning. Hands-On Practice. Sharper Skills.

The Annual Membership Program (AMP) keeps your skills sharp with rotating hands-on challenges across Grimoires, Shiny Labs, and Cyber Range scenarios, plus access to 200+ Proving Grounds Practice machines. Members also benefit from quarterly updated CPE-eligible content, certification maintenance for select credentials, and continued access to previously purchased course materials.

→ Missing out? Get Your Membership Now

These labs are available with a Learn Enterprise license.

• CVE-2025-32463: A local privilege escalation lab built on CVE-2025-32463 in Sudo’s chroot option. The Defend version of this CVE is already in the Defensive Cyber Range.
• Driftwood: A Linux machine running a surf club website on a content management system, plus a custom staff console program.

Standalone machines:

• Aerobook: A Linux machine running a web-based travel booking application and a messaging broker, taken from a web foothold to root.
• BrightLedger (CVE-2025-67084): A Linux machine built on CVE-2025-67084, an authenticated file-upload vulnerability in InvoicePlane 1.6.3, taken through to full system compromise.
• Cinnabar: A Linux machine running a file-collaboration application with published source code
• CVE-2026-42601: A Linux machine built on CVE-2026-42601, an argument injection vulnerability in an ArchiveBox deployment.
• CVE-2026-4408: A Linux machine built on CVE-2026-4408, a command injection vulnerability in Samba’s SAMR password validation service.
• CVE-2026-52891: A Linux machine built on CVE-2026-52891, a command injection vulnerability in a Wekan deployment.
• CVE-2026-53576: A Linux machine built on CVE-2026-53576, an authentication bypass in the Kestra workflow orchestration platform. The offensive counterpart to last week’s Defend CVE-2026-53576.
• CVE-2026-9082: A Linux machine built on CVE-2026-9082, a PostgreSQL-specific SQL injection in the JSON:API endpoint of Drupal 10.4.9, leading to remote code execution.
• CVE-2026-94545: A second-hand record shop’s web application built on CVE-2026-94545 in Next.js image generation. The offensive counterpart to last week’s Defend CVE-2026-94545.
• Denim: A Linux machine running an internal ticketing web application, taken from browser-based attacks to root.
• Happygift (CVE-2024-56519): A PrestaShop store built on CVE-2024-56519 in TCPDF, the PDF generation library, taken through to root.
• Invoitality: A Linux machine running a web-based invoicing and document-generation application.
• Maker: A binary exploitation challenge built around a MIPS-based retail application. Learners reverse engineer the program and develop an exploit that works past modern mitigations. A new architecture for binary exploitation in the Offensive Cyber Range.
• Simposio: A Linux machine running a support messaging portal, taken from a browser-driven web attack to root.
• SkyVault: A Linux machine running a web-based file storage and sharing application.
• Swarm (CVE-2026-59726): A Linux machine built on CVE-2026-59726, an unauthenticated remote code execution vulnerability in the Ruflo MCP Bridge for AI agents. A new AI agent infrastructure target.
• Zep: A Linux machine running a web search application, a source-code hosting service, and an interactive notebook service.

Multi-host environments:

• MisDelegation: A four-machine Active Directory environment with a public web server, SQL database services, and a domain controller, taken from the perimeter to full domain control.
• SantUbaldo: A three-machine corporate network of Linux and Windows hosts running web applications, databases, monitoring tools, and remote-access services, chained together for full compromise.

• Defend CVE-2026-72875: Secure a vulnerable version of Dokploy, an open-source self-hosted platform, against a command-execution vulnerability (CVE-2026-72875).

Don’t have access to the content you want? Get training for yourself or your whole team.