🚨 We know you've heard about it. PHP2Shell, CVE-2026-109618 and CVE-2026-109619 expose critical flaws in PHP's core that could allow attackers to execute code remotely without authentication. We believe understanding an exploit means getting hands-on with it. We've released a FREE lab dedicated to CVE-2026-109618, alongside a technical breakdown of both vulnerabilities. Go beyond the headlines. Explore the vulnerability, understand the exploitation techniques, and put your skills to the test. 🔎 Read the technical breakdown: offsec.com/blog/php2shell-cr… 💻 Try the free lab: portal.offsec.com/machine/cv… #PHP2Shell #OffSec #Cybersecurity #ProvingGrounds

👀 We’re back. Come hang out! OffSec Live returns to Twitch and YouTube with course and Proving Grounds walkthroughs, technical deep dives, and career advice from the OffSec community. 👣 We’re kicking things off with Footprints in the Logs: Catching Lateral Movement. Join David Ethington, OffSec Seattle-USA Chapter Ambassador, as he follows an attacker’s trail through Windows logs, working backward from the final alert to the first compromise. TOMORROW! October 23, 3 PM ET / 7 PM UTC Bring your questions. We’ll see you in chat! Join us on YouTube: youtube.com/@OffSecTraining Tune in at Twitch: twitch.tv/offsecofficial/abo…

🚨 Actively Exploited: CVE-2026-85706 (CVSS 10.0). An unauthenticated path traversal in GitLab CE/EE allows attackers to read arbitrary files off your server. All it takes is one HTTP request to expose CI/CD secrets, deploy tokens, and SSH keys. Patch self-managed instances immediately (19.1.8 / 19.2.6 / 19.3.2). Want to see how this access-control failure works under the hood? Practice exploiting it safely in our new Offensive Cyber Range lab on Learn Enterprise. Try it here: bit.ly/4yqqKOe

The EU AI Act has put AI literacy, oversight, and workforce capability on the agenda. The next step is proving what your security team can do. Can your teams test AI systems under realistic conditions and uncover attacks that exploit legitimate behavior and may escape traditional controls? These hard-to-detect attack paths create an AI blind spot. Our whitepaper explores what it takes to move from awareness to proven capability. Download your free copy: offsec.com/business/eu-ai-re…

New labs are here! 💻 Ready to put your skills to the test? Check out the latest hands-on labs from OffSec and keep building your practical cybersecurity skills. We're releasing new labs every week, so there's always something new to explore and another challenge to tackle. See what's new this week: bit.ly/3U87iqt #OffSec #CybersecurityTraining #HandsOnLearning

Certified? Still working toward it? Just getting started? The OffSec Annual Membership Program meets you where you are with year-round access to hands-on training and regularly updated content. 🏅 Already certified? Earn CPE credits and keep an eligible certification active. 💻 Still learning? Get more opportunities to practice and strengthen your approach. 💾 New to the OffSec Community? Start working in realistic environments and see where your skills can take you. Wherever you’re starting from, AMP gives you a way to keep progressing. Explore AMP: bit.ly/4ulvdjb

🏛️ Public sector cybersecurity missions depend on a workforce that's prepared to meet evolving threats. But how do you know your training strategy is building the skills your teams actually need? From identifying skill gaps to validating technical proficiency, workforce development requires more than completing training requirements. OffSec's Public Sector Cyber Workforce Training Blueprint offers a practical framework for evaluating your approach and strengthening mission readiness. Download the blueprint: offsec.com/business/public-s… #Cybersecurity #PublicSector #CyberWorkforceDevelopment

⏰ 24 hours. Vulnerable machines. An Active Directory set. And no answer key hiding somewhere in the back. The OSCP exam is designed to test more than what you know. It tests how you approach a problem, adapt when your first idea fails, and keep going when the obvious path leads nowhere. PEN-200 helps you build those skills. The OSCP exam asks you to prove them. Think you're ready for the challenge? See what the exam demands: help.offsec.com/hc/en-us/art…

😱 Someone will eventually click. The question is: Is your security team ready for what happens next? Cybersecurity awareness helps employees recognize and report threats. Awareness alone can't prevent every attack. When something gets through, your security team's ability to investigate, contain, and respond makes all the difference. For Cybersecurity Awareness Month, we spoke with members of OffSec's internal IT and security teams about why effective security preparation requires more than awareness training. Train for the click that gets through. Read the blog: bit.ly/48066c2 #CybersecurityAwarenessMonth #Cybersecurity #SecurityTraining

You're entering the final stretch of HackTrack. HackTrack continues with another Active Directory walkthrough featuring AD06. This week's focus: 🎟 Kerberoasting 🔓 UAC Bypass 🔑 Password Reuse 🛠 Public Exploit Validation Learn how attackers move beyond initial access by identifying opportunities throughout an Active Directory environment. 📅 Saturday 🕓 16:00 GMT Register Now: hubs.li/Q04rTkqs0 #TryHarder