Exploring this year's Cybersecurity Awareness Month theme and what it means for security teams.

The post Someone Clicked the Link. Is Your Security Team Ready? appeared first on OffSec.

CVE-2026-85706 is a critical, unauthenticated path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE).

The post CVE-2026-85706: GitLab Unauthenticated Arbitrary File Read via the Repository Commits API appeared first on OffSec.

Ten lessons from Black Hat and DEF CON on AI agents, cheaper attacks, supply chain risk, security fundamentals and cyber skills.

The post 10 Lessons Reshaping Security After Black Hat and DEF CON 2026 appeared first on OffSec.

The strongest response to AI-driven change is a workforce that can use faster tools without surrendering the judgment behind the work.

The post Are Security Teams Keeping Pace With AI-Accelerated Threats? appeared first on OffSec.

Learn all about OffSec's new Creator Platform - create labs, earn rewards and help the security community skill up.

The post What If Your Idea Became the Next OffSec Lab? appeared first on OffSec.

¡Hola a todos!  Con este post da comienzo una serie de 3 posts donde hablaré de las certificaciones que forman OSCE3 y de cómo yo me las he preparado.  ¿Qué es OSCE3?  Si llevas algún tiempo en el mundo de la ciberseguridad ofensiva, seguro que has oído hablar del OSCP (Offensive Security Certified Professional). Es

The post Road to OSCE3: Episodio 1 – OSEP appeared first on OffSec.

Most talk about offensive security agents is about power. Can it find the bug? Can it chain the exploit? Can it own the box? That’s the easy part. Wiring a model up to tools is normal engineering now, and raw capability improves on its own every time a new model ships. The parts that don’t

The post Knowing what not to attack appeared first on OffSec.

CVE-2026-72898 is a critical unauthenticated SQL injection in Metabase's password-reset functionality. Learn more about it.

The post CVE-2026-72898: Critical Metabase Unauthenticated SQL Injection Vulnerability appeared first on OffSec.

Learn how organizations can develop relevant offensive knowledge across every security function responsible for AI systems.

The post Who Secures AI When It Touches Every Security Team? appeared first on OffSec.

Introducing AI Red Teaming Upskill Program. New way to build AI security capabilities across teams with different roles and levels of experience. 

The post Introducing the AI Red Teaming Upskill Program appeared first on OffSec.

The recent water system attacks are a reminder that familiar techniques can have serious consequences when they reach critical infrastructure. Preparing teams before the next incident is just as important as responding to the last one.

The post What the Recent Water Systems Cyber Attacks Reveal About Critical Infrastructure Security appeared first on OffSec.

Recently, I read a great post by Melvin Tan Zhi Xian sharing his thoughts halfway through the OffSec OSAI+ course. He touched on something crucial that isn’t being talked about enough: how the methodology for attacking AI doesn’t map cleanly to a standard pentest framework. Melvin’s feedback really resonated with me. It sparked a deeper

The post Why “AI Pentesting” is the Wrong Term (And Why We Need AI Red Teaming) appeared first on OffSec.

If your agency is planning how to use remaining Fiscal Year funding, now is the time to build a stronger cybersecurity workforce.

The post How Federal Agencies Can Turn Year-End Funding Into Long-Term Cyber Capability appeared first on OffSec.

The EU AI Act deadline is approaching but the attack surface is already here. Is your workforce ready to secure it?

The post The EU AI Act Deadline Is Approaching. Is Your Workforce Ready? appeared first on OffSec.

Learn how live cybersecurity training helps teams strengthen technical judgment before it matters most.

The post What Security Leaders Discover When They Train Their Team in the Same Room  appeared first on OffSec.

When does your organization need traditional penetration testing, when does it need AI security testing, and when does it need both?

The post AI vs Traditional Penetration Testing: Which Approach Is Right for Your Organization? appeared first on OffSec.

Effective hardening requires balancing security, operational needs, and long term maintainability.

The post Intro to STIG Tools appeared first on OffSec.

How AI is changing cybersecurity training, why live learning matters, and how AI-300 helps professionals secure evolving AI systems.

The post Cybersecurity Training in the Age of AI appeared first on OffSec.

Second part of the AI vs Traditional Pentesting series, focusing this time on tools and outcomes of both approaches.

The post AI vs Traditional Penetration Testing: Tooling and Outcomes appeared first on OffSec.

Hear directly from OffSec's Live Training instructor on what makes live training different than self-paced training.

The post What Live Cybersecurity Training Reveals That Self-Paced Learning Doesn’t appeared first on OffSec.