OffSec✓

#OSAI is officially here! 📣🐺 OffSec’s newest certification for hands-on offensive operations against AI-enabled systems is now available for purchase with Learn One, Course & Cert Bundle, and Learn Enterprise. Built for practitioners who want to apply an adversary mindset to modern AI systems and stay ahead as the attack surface evolves. 🔗

🕵️‍♂️ The first unexpected MFA request was suspicious. 🤔 The second was also suspicious. ❌ By the seventh, clicking “Approve” does not become the recommended troubleshooting method. Cybersecurity Awareness Month reminder for the security teams dealing with what comes next: attackers only need one opening. Make sure your team knows what to do when they get it. #CybersecurityAwarenessMonth #OffSec #TryHarder

Two analysts can share a title, a certification, and years on the job, yet one handles an incident far better than the other. Most CISOs know that gap exists. Few can prove it to their board. OffSec just mapped its hands-on training library to NICE, DCWF, ECSF, and other global workforce frameworks. Security leaders can now show which skills their teams have, which they still need, and how to close the gap. Read the full announcement: #Cybersecurity #CyberWorkforce #CISO

OffSec is hitting the road in November. Come find us. 🌍 🇯🇵 CODE BLUE, Tokyo | Nov 17–18 We'll be at one of Asia's top security conferences. Stop by and say hello. 🤝 OffSec Community Chapter Meetups 🇨🇦 Vancouver | Nov 6 🇫🇷 Paris | Nov 12 🇪🇸 Madrid | Nov 15 Whether you're working toward your first cert or you've been in the field for years, our chapters are where practitioners meet up, swap stories and Try Harder together. Find a chapter near you or start one: See you out there. #OffSec #CODEBLUE #TryHarder #InfoSec #CybersecurityCommunity

Is AI allowed in the OSAI exam? How long does the course take to complete? 👀 Here are your all-important OSAI questions, answered! 💬 🐺 Learn more: ❓ View FAQs:

40+ new labs. 2 critical PHP CVEs. 1 free lab. 🛑💻 We just pushed a massive content update. If you want to get hands-on with the new PHP2Shell vulnerability (CVE-2026-109618), we just dropped a technical breakdown and a FREE Proving Grounds Play lab so you can see how the RCE actually works. Plus, we added deep-dive Active Directory environments, web app challenges, and new Grimoires investigations for Learn Enterprise and AMP members. See the full list and start hacking: #OffSec #CyberSecurity #PHP2Shell #CVE #TryHarder

Is your cyber training program building the capabilities your technology organization actually needs? As cloud environments expand, AI adoption accelerates, and attack surfaces evolve, cybersecurity leaders need to know whether their teams’ skills are keeping pace. 📑 Our new guide includes a 5-point checklist to help evaluate your training strategy, identify critical skill gaps, and prioritize development. Plus, discover how Cisco and EPAM approach building cybersecurity talent through structured, continuous learning. 📥 Download the free guide:

One SQL injection vulnerability. Multiple paths to initial access. 🔍💻 Finding a vulnerability is just the beginning. Knowing how to build on what you've discovered is where your penetration testing skills come into play. In our latest video walkthrough, we explore how to turn a WordPress SQL injection finding into a working shell by following the evidence and testing each potential attack path. Key takeaways from this session: 🔎 SQL Injection: Use WPScan findings to identify a vulnerable plugin and manually extract WordPress user credentials. 🔑 Credential Discovery: Crack password hashes with Hashcat and investigate credential reuse across services. 🛠️ From FTP to SSH: Explore WordPress configuration files, uncover additional credentials, and leverage them to gain initial access. Watch the full walkthrough and see how each finding leads to the next. 🎥

🚨 We know you've heard about it. PHP2Shell, CVE-2026-109618 and CVE-2026-109619 expose critical flaws in PHP's core that could allow attackers to execute code remotely without authentication. We believe understanding an exploit means getting hands-on with it. We've released a FREE lab dedicated to CVE-2026-109618, alongside a technical breakdown of both vulnerabilities. Go beyond the headlines. Explore the vulnerability, understand the exploitation techniques, and put your skills to the test. 🔎 Read the technical breakdown: 💻 Try the free lab: #PHP2Shell #OffSec #Cybersecurity #ProvingGrounds

👀 We’re back. Come hang out! OffSec Live returns to Twitch and YouTube with course and Proving Grounds walkthroughs, technical deep dives, and career advice from the OffSec community. 👣 We’re kicking things off with Footprints in the Logs: Catching Lateral Movement. Join David Ethington, OffSec Seattle-USA Chapter Ambassador, as he follows an attacker’s trail through Windows logs, working backward from the final alert to the first compromise. TOMORROW! October 23, 3 PM ET / 7 PM UTC Bring your questions. We’ll see you in chat! Join us on YouTube: Tune in at Twitch:

🚨 Actively Exploited: CVE-2026-85706 (CVSS 10.0). An unauthenticated path traversal in GitLab CE/EE allows attackers to read arbitrary files off your server. All it takes is one HTTP request to expose CI/CD secrets, deploy tokens, and SSH keys. Patch self-managed instances immediately (19.1.8 / 19.2.6 / 19.3.2). Want to see how this access-control failure works under the hood? Practice exploiting it safely in our new Offensive Cyber Range lab on Learn Enterprise. Try it here:

The EU AI Act has put AI literacy, oversight, and workforce capability on the agenda. The next step is proving what your security team can do. Can your teams test AI systems under realistic conditions and uncover attacks that exploit legitimate behavior and may escape traditional controls? These hard-to-detect attack paths create an AI blind spot. Our whitepaper explores what it takes to move from awareness to proven capability. Download your free copy:

New labs are here! 💻 Ready to put your skills to the test? Check out the latest hands-on labs from OffSec and keep building your practical cybersecurity skills. We're releasing new labs every week, so there's always something new to explore and another challenge to tackle. See what's new this week: #OffSec #CybersecurityTraining #HandsOnLearning

Certified? Still working toward it? Just getting started? The OffSec Annual Membership Program meets you where you are with year-round access to hands-on training and regularly updated content. 🏅 Already certified? Earn CPE credits and keep an eligible certification active. 💻 Still learning? Get more opportunities to practice and strengthen your approach. 💾 New to the OffSec Community? Start working in realistic environments and see where your skills can take you. Wherever you’re starting from, AMP gives you a way to keep progressing. Explore AMP:

🏛️ Public sector cybersecurity missions depend on a workforce that's prepared to meet evolving threats. But how do you know your training strategy is building the skills your teams actually need? From identifying skill gaps to validating technical proficiency, workforce development requires more than completing training requirements. OffSec's Public Sector Cyber Workforce Training Blueprint offers a practical framework for evaluating your approach and strengthening mission readiness. Download the blueprint: #Cybersecurity #PublicSector #CyberWorkforceDevelopment

⏰ 24 hours. Vulnerable machines. An Active Directory set. And no answer key hiding somewhere in the back. The OSCP exam is designed to test more than what you know. It tests how you approach a problem, adapt when your first idea fails, and keep going when the obvious path leads nowhere. PEN-200 helps you build those skills. The OSCP exam asks you to prove them. Think you're ready for the challenge? See what the exam demands:

😱 Someone will eventually click. The question is: Is your security team ready for what happens next? Cybersecurity awareness helps employees recognize and report threats. Awareness alone can't prevent every attack. When something gets through, your security team's ability to investigate, contain, and respond makes all the difference. For Cybersecurity Awareness Month, we spoke with members of OffSec's internal IT and security teams about why effective security preparation requires more than awareness training. Train for the click that gets through. Read the blog: #CybersecurityAwarenessMonth #Cybersecurity #SecurityTraining

OffSec will be at ISTC 2026 in Muscat, on October 20–21 🇴🇲 Tools, policies and frameworks all matter. But when an attack happens, what counts is whether your team has the practical skills to respond. That’s what we help organisations build and prove, through hands-on training, Cyber Range exercises and certifications like OSCP+. Visit our booth to find out how we can support your team’s development. 📍 OCEC, Grand Ballroom, Muscat 📅 20–21 October 2026 🔗 Register: #TryHarder #ISTC2026 #Oman #Cybersecurity #OffSec

You're entering the final stretch of HackTrack. HackTrack continues with another Active Directory walkthrough featuring AD06. This week's focus: 🎟 Kerberoasting 🔓 UAC Bypass 🔑 Password Reuse 🛠 Public Exploit Validation Learn how attackers move beyond initial access by identifying opportunities throughout an Active Directory environment. 📅 Saturday 🕓 16:00 GMT Register Now: #TryHarder

Cybersecurity Awareness Month comes with plenty of good advice: 🤔 Think before you click. 💪 Use strong passwords. ➕ Turn on MFA. 📢 Report suspicious activity. And someone’s still going to click it. Awareness helps reduce risk. But when prevention fails, your security team needs the practical skills to investigate what happened, understand the attack path, and respond. Train for what happens next. #CybersecurityAwarenessMonth #OffSec #TryHarder

What could you accomplish in 90 days? Build your first AI red teaming methodology. Take your penetration testing skills further. Learn to hunt threats. Get better at finding what others miss in web applications. Choose your cybersecurity goal. The Course + Cert Bundle gives you 90 days of focused course content, hands-on labs, and exam preparation to build your skills and prove what you know. Explore the Course + Cert Bundles: