October 26 – November 2, 2026 – Content & Platform Updates

Last week we added 41 hands-on labs, led by investigations of major real-world incident types and a wide run of offensive labs built on self-hosted developer and operations tools.

Check out the full release list below ⬇️

More labs. More ways to keep your skills sharp.

The Annual Membership Program (AMP) gives members a rotating selection of hands-on challenges across Grimoires, Shiny Labs, Cyber Range environments, and Proving Grounds Practice. If you’ve previously purchased an OffSec course, you can also revisit your course materials and videos.

These labs are available with a Learn Enterprise license. 

• Backlog: Backlog Freight & Warehousing left a Group Policy delegation and a patch-automation server in place long after a migration project. An Active Directory investigation.
• Black River Defense: Black River Hydro runs a small hydroelectric plant with an operator HMI, a Modbus TCP gateway, and a historian server. A diagnostics bundle nobody staged is applied at dawn. An operational technology investigation.
• Board Pack: A workstation in a partner organization’s range reads shared dashboards and then reaches a terminal on the dashboard host without credentials. A dashboard platform investigation.
• Cascade Defense: Northwind Freight’s self-hosted workflow-automation platform shows an overnight SSH login for a service account that never signs in interactively. A web and automation-platform investigation.
• ChronoPress Incident: ChronoPress, an online watch retailer on WordPress, sees unusual requests against its product API. Learners trace the intrusion from host and network evidence.
• Closed Ticket: Vantrel Logistics hosts its own internal chat server and worked a security ticket about a default administrator account in stages. Learners determine what happened before the fix was complete.
• Colophon Defense: An accounts-payable team’s supplier-document intake portal is compromised. Learners reconstruct the intrusion from telemetry while separating it from legitimate activity that looks similar.
• Cutoff: Northvale Fulfilment’s automation platform shows workflow runs nobody started, and a reconciliation check fails to balance. An automation-platform investigation.
• DoubleEdged: Unusual web traffic, authentication events, and certificate operations span a Linux web server and a Windows domain controller. Learners work from logs and a packet capture across both machines.
• Hartwell: Hartwell Supply Co., an industrial distributor, receives an intrusion alert for a DMZ web server opening an outbound connection. Learners reconstruct a multi-stage intrusion across two hosts.
• Hidden Thread: Keystone Build Group, a construction firm on Microsoft 365, finds a client paid a large progress draw to a fraudulent account after an email from its accounts-payable controller that she never sent. A cloud email compromise investigation.
• House Edge: Crescent Bay Resorts & Casinos finds much of its VMware estate offline with a ransom note on its datastores. The intrusion began with a single call to the IT service desk. A social engineering and ransomware investigation.
• Keyframe Defense: Crosswire News’s internal clip-submission and video platform is compromised. Learners work through three weeks of newsroom telemetry to separate the attack from ordinary activity.
• Last Seen: Novamour, a dating and community platform, finds a reported profile’s album emptied overnight. A web application and API investigation.
• Night Shift: Nordhafen Logistik tracks compulsory training on its ILIAS learning platform. An unexpected file in the web root and an improperly issued certificate start the investigation.
• Noctiluca: Noctiluca Financial Services commissioned an authorized penetration test across four Active Directory hosts, and the red team held back the technical details. Learners reconstruct the engagement from the blue-team evidence.
• Operation Quiet Tenant: A hosting provider’s malware sweep finds an unexpected PHP file on a small WordPress brochure site with automatic updates enabled. A web hosting investigation.
• Retainer: Northbank Studio, a design agency on a self-hosted Leantime instance, hears from a client that a signed contract and the studio’s rate card have surfaced where they should not be.
• Sealed Bid: Halbrook and Sayer, an engineering practice running public tenders, sees a staff member locked out of its extranet the night before a closing date, followed weeks later by a complaint from a losing bidder.
• Severed Tunnel: Fernwood Dynamics, an aerospace and defense components supplier, receives a threat-intel notice about an unfamiliar address seen on its SSL VPN portal weeks earlier, while the vendor’s integrity checker reports nothing wrong. A network edge appliance investigation.
• String Freeze: Vireo Loc, a games localization vendor, finds a corrupted launch file in a build shortly before release. A file-sharing and supply-chain investigation.
• Weather Window: Marrick O&M Services coordinates offshore wind farm maintenance on a self-hosted project platform with read-only contractor shares. Unusual outside API traffic starts the investigation.

• Berserker: A Linux machine running a blog application, taken from web access to root.
• Bomba: A Linux machine running a note-sharing web application, taken from web access to root.
• CVE-2026-33130: A Linux machine that starts at an exposed Vite development server and reaches Uptime Kuma, built on CVE-2026-39363 and CVE-2026-33130.
• CVE-2026-48126: A Linux machine built on CVE-2026-48126, a Host header path traversal in the Algernon web server 1.17.7.
• CVE-2026-49869: A Linux machine built on CVE-2026-49869, an authentication bypass in Kestra, the open-source orchestration platform, taken through to full host compromise.
• CVE-2026-58123: A Linux machine built on CVE-2026-58123, an unauthenticated remote code execution vulnerability in Hermes WebUI 0.51.787.
• CVE-2026-87902: An outdoor retailer’s WordPress 7.0.2 site built on CVE-2026-87902, a local file inclusion vulnerability, taken through to root.
• Detonator: A Linux machine running a malware-analysis sandbox web application, taken across several accounts to root.
• DotChatMe: A Windows machine serving a web message board whose posts are opened by a desktop client, taken through to full system control.
• Enerva: A Linux machine running a managed file-transfer application with an admin panel.
• gituma: A Linux machine with a Git service, an API, and a self-hosted monitoring application.
• Obelisk: A Linux machine whose web front end relays frames to a custom event-broker service.
• Quorum: A Linux machine running a real-time collaborative document application, taken through to root.
• Spindle: A Linux machine running a self-hosted Git service, taken across several accounts to root.
• T-exchange: An AI-driven tool marketplace with an automated reviewer and an agent. A new AI application target.
• Vasco: A Linux machine running an e-commerce application with a separate admin subdomain.

• Defend CVE-2026-47884: Secure a vulnerable version of Spring, the Java web framework, against a vulnerability that exposes internal services to attackers (CVE-2026-47884).
• Defend CVE-2026-53576: Secure a vulnerable version of Kestra, an open-source orchestration platform, against a command-execution vulnerability (CVE-2026-53576).
• Defend CVE-2026-94545: Secure a vulnerable version of Next.js, the React web framework, against a code-execution vulnerability (CVE-2026-94545).

Don’t have access to the content you want? Get training for yourself or your whole team.