How out-of-memory corruption and stale worker state became two critical PHP RCEs and why the original exploit theory got it wrong.

The post php2shell: anatomy of two PHP lifecycle bugs appeared first on OffSec.

For Cybersecurity Awareness Month, we spoke with 3 members of OffSec's IT and security teams about what effective security awareness looks like.

The post Someone Will Click. Is Your Security Team Ready? appeared first on OffSec.

Two major CVEs have been discovered in PHP core, both rated critical, leading to server crashes and potential remote code execution on affected web servers.

The post PHP2Shell – Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619) appeared first on OffSec.

OffSec's new framework hub shows security leaders what their teams can do and how to prove it.

The post OffSec Aligns Its Cyber Workforce Development Programs to Global Workforce Frameworks appeared first on OffSec.

Learn all about scoring updates to the OSCP exam that are starting on December 1, 2026.

The post OSCP+ Scoring Update: What You Need to Know appeared first on OffSec.

Learn what to expect from OSCP, including format, requirements, scoring, practical study tips, and answers to common preparation questions.

The post OSCP Exam Guide: What to Expect and How to Prepare appeared first on OffSec.

Exploring this year's Cybersecurity Awareness Month theme and what it means for security teams.

The post Someone Clicked the Link. Is Your Security Team Ready? appeared first on OffSec.

CVE-2026-85706 is a critical, unauthenticated path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE).

The post CVE-2026-85706: GitLab Unauthenticated Arbitrary File Read via the Repository Commits API appeared first on OffSec.

Ten lessons from Black Hat and DEF CON on AI agents, cheaper attacks, supply chain risk, security fundamentals and cyber skills.

The post 10 Lessons Reshaping Security After Black Hat and DEF CON 2026 appeared first on OffSec.

The strongest response to AI-driven change is a workforce that can use faster tools without surrendering the judgment behind the work.

The post Are Security Teams Keeping Pace With AI-Accelerated Threats? appeared first on OffSec.

Learn all about OffSec's new Creator Platform - create labs, earn rewards and help the security community skill up.

The post What If Your Idea Became the Next OffSec Lab? appeared first on OffSec.

¡Hola a todos!  Con este post da comienzo una serie de 3 posts donde hablaré de las certificaciones que forman OSCE3 y de cómo yo me las he preparado.  ¿Qué es OSCE3?  Si llevas algún tiempo en el mundo de la ciberseguridad ofensiva, seguro que has oído hablar del OSCP (Offensive Security Certified Professional). Es

The post Road to OSCE3: Episodio 1 – OSEP appeared first on OffSec.

Most talk about offensive security agents is about power. Can it find the bug? Can it chain the exploit? Can it own the box? That’s the easy part. Wiring a model up to tools is normal engineering now, and raw capability improves on its own every time a new model ships. The parts that don’t

The post Knowing what not to attack appeared first on OffSec.

CVE-2026-72898 is a critical unauthenticated SQL injection in Metabase's password-reset functionality. Learn more about it.

The post CVE-2026-72898: Critical Metabase Unauthenticated SQL Injection Vulnerability appeared first on OffSec.

Learn how organizations can develop relevant offensive knowledge across every security function responsible for AI systems.

The post Who Secures AI When It Touches Every Security Team? appeared first on OffSec.

Introducing AI Red Teaming Upskill Program. New way to build AI security capabilities across teams with different roles and levels of experience. 

The post Introducing the AI Red Teaming Upskill Program appeared first on OffSec.

The recent water system attacks are a reminder that familiar techniques can have serious consequences when they reach critical infrastructure. Preparing teams before the next incident is just as important as responding to the last one.

The post What the Recent Water Systems Cyber Attacks Reveal About Critical Infrastructure Security appeared first on OffSec.

Recently, I read a great post by Melvin Tan Zhi Xian sharing his thoughts halfway through the OffSec OSAI+ course. He touched on something crucial that isn’t being talked about enough: how the methodology for attacking AI doesn’t map cleanly to a standard pentest framework. Melvin’s feedback really resonated with me. It sparked a deeper

The post Why “AI Pentesting” is the Wrong Term (And Why We Need AI Red Teaming) appeared first on OffSec.

If your agency is planning how to use remaining Fiscal Year funding, now is the time to build a stronger cybersecurity workforce.

The post How Federal Agencies Can Turn Year-End Funding Into Long-Term Cyber Capability appeared first on OffSec.

The EU AI Act deadline is approaching but the attack surface is already here. Is your workforce ready to secure it?

The post The EU AI Act Deadline Is Approaching. Is Your Workforce Ready? appeared first on OffSec.