October 19 – 25, 2026 – Content & Platform Updates

This week, we are back with over 40 new labs across different environments, with a deep run of web application and software delivery machines, Active Directory, and investigations across finance, telecom, identity, and publishing.

Browse the full release list below ⬇️

Two critical vulnerabilities in PHP core are making headlines. Dubbed PHP2Shell, the flaws can cause server crashes and potentially allow remote code execution (RCE) on affected web servers.

Our research team breaks down the vulnerabilities, how they can be exploited, and what defenders should know in our latest technical analysis.

Explore the PHP2Shell Technical Analysis →

Want to try the exploit yourself?

We’ve already released a free Proving Grounds Play lab for CVE-2026-109618. Get hands-on with the vulnerability in a controlled environment and see how the attack works.

Try the Free PHP2Shell Lab →

More labs. More ways to keep your skills sharp.

The Annual Membership Program (AMP) gives members a rotating selection of hands-on challenges across Grimoires, Shiny Labs, Cyber Range environments, and Proving Grounds Practice. If you’ve previously purchased an OffSec course, you can also revisit your course materials and videos.

New in AMP this week: 

• Past Due: Halstead & Roe, a civil engineering firm, finds its clients were sent invoices asking them to pay to new bank details. Learners work from billing and mail server logs and a packet capture. An invoice-fraud investigation. Also in AMP.
• Round the Clock: Brackenhill Outfitters runs its online shop on Sylius. An unrequested password reset is followed by an unknown administrator account. An e-commerce investigation. Also in AMP.

• Stoke (CVE-2026-42779): A Linux machine built on CVE-2026-42779, a Java deserialization flaw in Apache MINA 2.2.5, on a node coordination platform. Now in the AMP library.
• NexusFi: A simulated trading platform with a web API, a local blockchain node, and a WebAssembly engine. Now in the AMP library.

→ Missing out? Get Your Membership Now

These labs are available with a Learn Enterprise license. 

[Start training with Learn Enterprise]

• Day One: A design studio moves its client work onto a self-hosted Plane instance, and a second administrator account appears before the real administrator signs in. A project-platform investigation.
• Failover: Harbourline Hosting runs managed nginx front ends for small businesses. An unknown operator account, an unticketed reload, and an unexpected directory listing lead the investigation.
• Galley Proof: Marram Press, an independent publisher, runs a self-hosted file conversion service for its freelance typesetters. Material for unannounced titles is at risk the day before a major release.
• Golden Path: Alderpoint Freight Systems builds service documentation through an internal developer portal. On a migration day, a failed build is followed by data leaving the artifact host. A software supply-chain investigation.
• Good Standing: Lynx operates a regional exchange, a managed routing-security service, and a member portal. During a busy service window some member connections fail while others continue. A network and routing investigation.
• Hard Bounce: Thornbury Roast Co. runs WordPress with a CRM plugin. During a campaign launch, an unknown account becomes administrator and the customer list leaves the site.
• Headcount: Aldgrove Shared Services runs finance and HR for several client companies on one multi-tenant JeecgBoot platform. A client-side account signs in from an unfamiliar address during quarter-end close. A multi-tenant access investigation.
• Late Submission: Calder State University’s Computer Science department runs its own Git service and grading server. After a submission collection run, the head TA’s shells start behaving unexpectedly. An education-sector investigation.
• Locked Picture: Tidewell Post, a post-production house, keeps its delivery paperwork on a File Browser instance behind single sign-on. Someone outside the company quotes an embargo date that never left the archive host.
• New Device: Marnholt Group runs all authentication for its companies through a self-hosted ZITADEL identity platform. A Group IT administrator finds her account asking for a security key she never registered. An identity-platform investigation.
• Operation Call Leg: Fondever Member Services runs a VoIP platform built on Kamailio, RTPEngine, Asterisk, employee softphones, and HOMER monitoring. A scheduled member callback appears to cross into an external partner platform. Learners work from network captures, SIP and PBX logs, endpoint data, and call recordings.
• Operation Late Fill: LSEK runs a FIX 4.4 order-entry gateway. A member reports an unexpected partial fill and cancellation. Learners use gateway captures, QuickFIX/J logs, and an execution ledger to reconstruct the session. A financial trading investigation.
• Operation Off-Wire: Meridian Freight Systems’ hosting provider reports unexplained outbound traffic from the server running its workflow orchestration platform. Learners work from a packet capture, proxy and application logs.
• Past Due: Halstead & Roe, a civil engineering firm, finds its clients were sent invoices asking them to pay to new bank details. Learners work from billing and mail server logs and a packet capture. An invoice-fraud investigation. 
• Peak Season: Maasrand Logistics runs partner integrations on an internal Kubernetes platform. An egress report shows data leaving the platform during a weekend cutover. A cloud-native investigation.
• PlainSight: An analyst flags unusual automated activity against an internal web portal. Learners reconstruct a full intrusion from the Linux web server through to the Windows domain controller using network captures and endpoint logs.
• Press Check: Wyley Production Services runs a proofing and print-production platform for university presses and journals. Unexpected renderer activity during a proofing shift starts the investigation.
• Round the Clock: Brackenhill Outfitters runs its online shop on Sylius. An unrequested password reset is followed by an unknown administrator account. An e-commerce investigation. 
• Side Note: A contractor with limited access reads and alters private messages on records outside their scope in a shared ERP system. An insider and access-control investigation.
• Street Date: Hollowpine Press, a comics publisher, runs a self-hosted Stump archive. On a release night, embargoed titles are taken and production queues are changed.

Standalone machines:

• DataRelay (CVE-2026-34197): A Linux machine built on CVE-2026-34197 in a misconfigured Apache ActiveMQ instance, leading to remote code execution and on to root.
• Devilops: A DevOps host with a developer portal, a CI server, and an internal package index. Learners breach the build pipeline and escalate to root.
• Enmienda: A web-based vulnerability disclosure platform with an internal monitoring service, taken through to root.
• Heaplify: A binary exploitation challenge built around a custom C program with a heap-based page manager.
• Hilada: A Linux machine running a web-based student information system, taken from an unauthenticated web user to root.
• MemoVault A note-taking web application with a separate RPC service, combining client-side and service-side weaknesses on the way to root.
• NexusFi: A simulated trading platform with a web API, a local blockchain node, and a WebAssembly engine. 
• OpenEdx: A learning-management platform served across several virtual hosts with an internal API, taken through to root.
• PySeal: A software supply-chain platform with a multi-stage package pipeline of sandboxed backend services.
• sauisreal: A team-management web platform backed by a database and an internal remote-desktop service, taken through to root.
• Shinigami: A Linux machine running a Python web chat application that searches case records, taken from an unauthenticated web user to root.
• Slipstream: A Linux machine with a status-board web front end and a workflow-orchestration platform, taken through to root.
• Stitch: A Linux machine running a TLS web service behind an in-house reverse proxy, taken through to root.
• StitchTwo: A business email-routing platform behind a custom reverse proxy, with operator access through a single sign-on identity provider.
• Stoke (CVE-2026-42779): A Linux machine built on CVE-2026-42779, a Java deserialization flaw in Apache MINA 2.2.5, on a node coordination platform. 

Multi-host environments:

• Contact: A three-machine environment pairing a Linux cloud-services host with a Windows CI server and an Active Directory domain controller, taken through to full domain compromise.
• Kappa: A three-machine Active Directory environment with a Windows domain controller, a Windows telemetry server running an internal operations portal, and a Linux mail server.
• Vertex: A three-machine Active Directory environment with a domain controller, a database server, and a file server, taken through to full domain compromise.

• Defend CVE-2026-45695: Secure a vulnerable version of Kopia against a command-execution vulnerability (CVE-2026-45695).
• Defend CVE-2026-56290: Secure a vulnerable version of Page Builder CK, a Joomla extension, against an arbitrary file-upload vulnerability (CVE-2026-56290).
• Defend CVE-2026-7816: Secure a vulnerable version of pgAdmin, the graphical interface for PostgreSQL, against a command-execution vulnerability (CVE-2026-7816).

Don’t have access to the content you want? Get training for yourself or your whole team.