November 9 – November 15, 2026 – Content & Platform Updates

This week the OffSec Learning Library launched 34 new hands-on labs, featuring investigations of CI/CD and supply-chain attacks, offensive labs on container and Kubernetes infrastructure, and a two-host environment built around a police dispatch system.

Continuous Learning. Hands-On Practice. Sharper Skills.

The Annual Membership Program (AMP) keeps your skills sharp with rotating hands-on challenges across Grimoires, Shiny Labs, and Cyber Range scenarios, plus access to 200+ Proving Grounds Practice machines. Members also benefit from quarterly updated CPE-eligible content, certification maintenance for select credentials, and continued access to previously purchased course materials.

→ Missing out? Get Your Membership Now

• GetSetGo: A Linux machine hosting a Java web application server, taken from a web foothold to root.
• IronSpire: A Linux machine hosting a web application, with layered privilege escalation on the way to root.

These labs are available with a Learn Enterprise license.

Standalone machines:

• Anniechez: A Linux machine hosting a web console, with a reverse engineering stage on the way to root.
• Brine: A Linux machine running public and internal web services, taken from a web foothold to root.
• Broadsheet: A Linux machine hosting a PHP web publishing platform, taken from a web foothold to root.
• Curator: A Linux machine hosting a web asset-management application and a database service, taken from a web foothold to root.
• CVE-2025-1974: A Kubernetes cluster exposing a misconfigured Ingress-Nginx controller with CVE-2025-1974, the remote code execution flaw known as “IngressNightmare”, taken through to a shell on the underlying host.
• CVE-2026-42238: A Linux machine built on CVE-2026-42238 in nginx-ui 2.3.7, an insecure restore mechanism that allows unauthenticated remote code execution.
• Emudhra Compromise: A lab built around the real-world eMudhra intermediate certificate compromise. Learners start with access to a target that still trusts the compromised certificates and use that trust to reach root. A new certificate-trust scenario for the Offensive Cyber Range.
• Erlang tuzog’i (erlang-trap): A Linux machine exposing two SSH-style services, one of them custom-built.
• Jeopardy/PWN BurnableNote: A binary exploitation challenge built on a custom networked note-taking service. Learners analyze the provided binary and develop a working exploit for remote code execution.
• MeterFold: A PostgreSQL-focused lab combining CVE-2018-1058 and tenant isolation flaws with Linux privilege escalation.
• Phoenix: A Windows Active Directory lab centered on a domain controller, taken through to Domain Admin.
• SilverLining: A Linux machine running a web application and a container-orchestration API, taken from a web foothold to root.
• Softpen: A Linux machine hosting a web application, where learners move across several user accounts on the way to root.
• VikinGuard: A Linux machine running a web application and a container-orchestration API, taken from a web foothold to root.
• Wireguard: A VPN endpoint and a TLS admin panel guarding an internal network, taken through to root on the internal side.

Multi-host environments:

• dispatch: A police department website backed by a dispatch system, plus a web-based remote desktop that simulates a police mobile data terminal. A new public-safety setting for the Offensive Cyber Range.

• BUILDWRAITH: A suspicious interaction with a CI platform opens an investigation that correlates CI server logs, build records, a command-and-control collector, and a packet capture. A CI/CD pipeline-poisoning investigation.
• Dinner Rush: A restaurant group learns from a courier partner that its customer records are for sale on a forum. Learners work from the web server’s logs to find out what happened overnight.
• Division Fault: A foundry stands up a new Windows Server 2022 host to run a vendor invoice portal on IIS, alongside its accounts-payable files. A Windows web server investigation.
• Embargo: On the evening before an awards ceremony, an engineering institute’s public comment moderation desk is compromised and member records leave the server.
• GhostWire: A B2B distributor’s customer portal sits behind an nginx reverse proxy on a host that stores a nightly export of customer account data. A routine access-log review starts the investigation.
• Lead Time: A password spray succeeds against a contract engineer’s account at an electronics manufacturer, and the session goes on to its self-hosted parts database.
• mlops-sandbox-grimoire: A design studio’s self-hosted ComfyUI render host shows a changed kernel setting and an unexplained process running as root. An investigation of AI image-generation infrastructure.
• Reading Week: A university library’s SLiMS 9 management system shows server errors during reading week. Learners use web, database, and network evidence to work out what happened.
• Stock Take: During a stock-take night, a retailer’s payment provider flags a discount code that gives away full-price orders, a code nobody on the merchandising team recognizes.
• Sworn Copy: A localization bureau’s self-hosted Nextcloud integrity check flags a file that should not be there.
• TicketVault Incident: After a sold-out concert goes on sale, finance finds VIP packages paid for with almost nothing and one wallet holding a large promotional credit. An e-commerce fraud investigation.
• Turnaround: A cruise line’s in-cabin entertainment catalog and the service that files catalog requests automatically are at the center of the investigation.
• Velundra : Velundra commissioned an authorized penetration test of its four-host Active Directory environment. Learners act as SOC analysts and reconstruct the engagement from logs and a full network capture.
• WormTongue: Visitors to the websites of an email-marketing provider’s customers start seeing a fake “verification” prompt that asks them to paste a command into Windows. A software supply-chain investigation that follows the attack from the provider’s CDN to a customer’s network.

Defend CVE-2026-41452: Secure a vulnerable version of Krayin CRM, an open-source CRM platform, against an authentication bypass (CVE-2026-41452).

Defend CVE-2026-2880: Secure a vulnerable version of Fastify, a web framework for Node.js, against an authentication bypass (CVE-2026-2880).

Don’t have access to the content you want? Get training for yourself or your whole team.