October 12 – 18, 2026 – Content & Platform Updates

We added 34 new labs this week! There are now blue team investigations that pair with recent offensive environments to give you an experience of incidents from both sides.

Check out the full release list ⬇️

More labs. More ways to keep your skills sharp.

The Annual Membership Program (AMP) gives members a rotating selection of hands-on challenges across Grimoires, Shiny Labs, Cyber Range environments, and Proving Grounds Practice. If you’ve previously purchased an OffSec course, you can also revisit your course materials and videos.

→ Missing out? Get Your Membership Now

These labs are available with a Learn Enterprise license. 

Paired with Offensive Cyber Range environments:

• Cargobay Defense: Northwind’s internal developer platform runs preview builds on a single-node Kubernetes cluster. The SOC flags an off-hours plan change, unscheduled builds, and a privileged pod. The blue-team counterpart to the Cargobay environment.
• Failback Defense: RidgeLine Logistics runs a backup and disaster-recovery console across three trust zones. An off-hours spike in restore activity and an unexpected SSH key on the database host open the incident. The blue-team counterpart to the FailBack environment.
• Imposition Defense: A full intrusion at Halcyon Press, a print house, from an initial web foothold through to the Windows domain. Learners work from estate logs, a directory snapshot, Group Policy material, and a memory capture. The blue-team counterpart to this week’s Imposition environment.
• Klaxon Defense: Meridian Response, a managed incident provider, runs a self-hosted on-call console across three hosts, including a high-value automation host. The blue-team counterpart to the Klaxon environment.
• Switchboard Defense: A managed helpdesk fronts an identity-sync backend and a corporate Active Directory forest with a certificate authority. A client tenant reports a stranger reading their tickets in the same week the SOC sees unusual Kerberos and certificate activity. The blue-team counterpart to the SwitchBoard environment.

More investigations:

• Cold Storage: Larkfield Systems finds a customer’s production database dump on a host that the customer never approved. Learners work from a packet capture, backup console records, and support desk data.
• Good First Issue: Arbormesh Networks builds its documentation with Hugo on a Gitea server that accepts outside contributors and creates a preview for every pull request. The publishing account signs in from an unrecognised address. A software supply-chain investigation.
• Headless Harvest: Norvex Logistics runs its website on Grav CMS with a REST API plugin for a partner integration. A new administrator account appears and an internal cache service logs outside connections. A web and network investigation.
• False Assurance: Arrivo’s Azure logging and archive environment looks normal, but auditing shows unexpected access to a separate continuity archive. A cloud investigation across Azure activity, policy, identity, and logging evidence.
• Idle Worker: Oostveen Data Services runs customer data pipelines through a single workflow orchestrator. An unfamiliar namespace with a single flow appears overnight. A data-pipeline investigation.
• Last Octet: Greystone Telecom, a regional carrier, accidentally exposed its phpIPAM address-management system to the internet during a firewall migration. A telecom network investigation.
• Launch Day: Pagewell’s marketing site generates branded share cards for a public launch wall, and an intruder uses it to publish a card in the company’s name. A web-application investigation.
• Mailroom Defense: At Meridian Freight Logistics, unexpected file permissions and a new error from a daily maintenance job lead to an investigation across three weeks of logs on a customer support host.
• Moerol Research: Moerol University sees an unexpected finance-record change, endpoint protection problems, and an unfamiliar account. Learners reconstruct the incident across an operations host, the domain controller, and network captures.
• PingPong: Sensitive internal documents from a company file-share platform appear on the dark web after staff redundancies. Learners determine whether and how the platform was compromised.
• Push To Talk: Kelder Hosting, a game-server provider, finds a TeamSpeak administrator key that no one created. Learners use a network capture, web and application logs, and a ticket database export.
• Shop Ride: Alder Cycles, a bicycle shop, finds an unrecognised plugin on its e-commerce site, installed through an administrator’s own session. A small-business e-commerce investigation.
• Stratex: Stratex Financial Services commissioned an authorized penetration test of its on-premises Active Directory with full logging enabled across three hosts. Learners reconstruct the engagement from the defender’s evidence.

Standalone Machines:

• BusinessMan: A Linux machine with a public contact form, an authenticated admin console, and an automated browsing bot.
• Docil: A Linux machine running an HR directory portal, taken from web API weaknesses through to root.
• CVE-2026-44339: A Linux machine built on CVE-2026-44339 in PraisonAI Agents 1.6.36, an AI agent framework, exposed through its Model Context Protocol server and leading to code execution.
• GhostWire: A Linux machine running a web-based VPN management platform built on a client-side WebAssembly module, token authentication, and a secrets manager.
• Halftone: A Linux print gateway with SSH, SMB, and rsync services, taken from a foothold through to root.
• InboxZero: A Linux machine running self-hosted webmail with an integrated AI assistant, where full compromise takes several layers of access.
• MeridianSCADA: A water-treatment SCADA lab with an operator (HMI) web interface and industrial field controllers on a segmented network. A new industrial control system target.
• Nightjar: A Linux machine with a web file share and a red-team command-and-control teamserver, taken from leaked operator access through to root.
• SkillEmporium: A Linux machine running a web-based learning management system with file download, authentication, and certificate-templating features.
• Vaultbreach-fincloud: A financial reporting portal running inside a Kubernetes cluster with a secrets-management service, taken through to full compromise of the host.

Multi-Host Environments:

• Imposition: A four-machine environment that starts at a Linux print server with a web portal and moves into a Windows Active Directory domain through to full domain compromise. Pairs with this week’s Imposition Defense Grimoire.
• NEXUS: A three-machine Windows Active Directory environment with a domain controller and two workstations, taken from domain enumeration through to domain administrator.
• NovaSphereTech: A four-machine Active Directory environment built around a Linux web application and several Windows domain servers, taken through to domain compromise.

• Defend CVE-2026-44578: Secure a vulnerable version of Next.js, the React web framework, against a vulnerability that exposes internal services to attackers (CVE-2026-44578).
• Defend CVE-2026-72603: Secure a vulnerable version of WireGuard, the open-source VPN, against a command-execution vulnerability (CVE-2026-72603).
• Defend CVE-2026-88062: Secure a vulnerable version of Omniroute, an open-source AI gateway, against a command-execution vulnerability (CVE-2026-88062).

Don’t have access to the content you want? Get training for yourself or your whole team.