Cyber Security
Defend, investigate and attack (legally). Security operations, forensics, cryptanalysis, reverse engineering and application security.
115 labs
Beginner
Evidence Intake & Hash Verification
Receive a USB drive image for a live case, identify it by its contents, verify it against the field examiner's hashes, catch a tampered working copy, and take in new evidence with an unbroken chain of custody.
Beginner
AI Platform Patch Triage & Remediation: CVE-2025-3248
Triage a Critical, CISA-KEV-listed Langflow unauthenticated code-injection RCE (CVE-2025-3248) on /api/v1/validate/code: confirm the version, score it with CVSS, identify CWE-306, judge the pre-auth exposure, upgrade and verify, and recognize that the endpoint should require auth.
Beginner
Analytics Server Patch Triage & Remediation: CVE-2023-38646
Triage a Critical, CISA-KEV-listed Metabase unauthenticated H2 JDBC RCE (CVE-2023-38646): confirm the version, score it with CVSS, identify CWE-94, judge the pre-auth exposure, upgrade and verify.
Beginner
Appliance Patch Triage & Remediation: CVE-2026-10520
Triage a maximum-severity, CISA-KEV-listed Ivanti Sentry unauthenticated OS command injection (CVE-2026-10520) that gives root RCE: confirm the build, score it with CVSS, identify CWE-78, judge the pre-auth appliance exposure, upgrade and verify, and recognize that the management interface should be restricted.
Beginner
Application Server Patch Triage & Remediation: CVE-2025-24813
Triage a maximum-severity, CISA-KEV-listed Apache Tomcat partial-PUT path-equivalence finding (CVE-2025-24813) that can reach RCE: confirm the version and the enabling config, score it with CVSS, identify CWE-44 + CWE-502, judge exposure, upgrade and verify, and recognize the hardening that breaks the chain.
Beginner
Application Server Patch Triage & Remediation: CVE-2026-48282
Triage a maximum-severity, CISA-KEV-listed Adobe ColdFusion path-traversal-to-RCE finding (CVE-2026-48282): confirm the version, score it with CVSS, identify CWE-22, judge the pre-auth exposure, apply the APSB26-68 update and verify, and recognize the lockdown hardening.
Beginner
Automation Platform Patch Triage & Remediation: CVE-2025-68613
Triage a Critical, CISA-KEV-listed n8n workflow-expression RCE (CVE-2025-68613) where a low-trust editor escapes the expression sandbox to run code on the server: confirm the version, score it with CVSS and see why it is 9.9 despite needing a login (scope changed), identify CWE-913, judge the insider threat model, upgrade and verify.
Beginner
BI Platform Patch Triage & Remediation: CVE-2026-72898
Triage a maximum-severity, CISA-KEV-listed Metabase unauthenticated SQL injection (CVE-2026-72898) on /reset_password that yields admin: confirm the version, score it with CVSS, identify CWE-89, judge the pre-auth exposure, upgrade and verify, and recognize that exploited instances need credential rotation.
Beginner
CI/CD Patch Triage & Remediation: CVE-2024-23897
Triage a Critical, CISA-KEV-listed Jenkins CLI arbitrary-file-read finding (CVE-2024-23897): confirm the version, score it with CVSS and see why a file read is 9.8 (unauthenticated, reads controller secrets), identify CWE-27, judge the pre-auth exposure, upgrade and verify, and rotate exposed secrets.
Beginner
DBA Tool Patch Triage & Remediation: CVE-2024-2044
Triage a Critical pgAdmin 4 session path-traversal-to-pickle-RCE finding (CVE-2024-2044): confirm the version, score it with CVSS, identify CWE-31, judge the authenticated low-trust exposure, upgrade and verify, and recognize that exploited instances need credential rotation.
Beginner
Device Patch Triage & Remediation: CVE-2026-2329
Triage a Critical unauthenticated-RCE finding (CVE-2026-2329) across a fleet of Grandstream GXP16xx IP phones: confirm the firmware, score it with CVSS, judge network exposure, push the fixed firmware and verify the fleet is clean.
Beginner
Firewall Patch Triage & Remediation: CVE-2024-3400
Triage a maximum-severity, CISA-KEV-listed PAN-OS GlobalProtect unauthenticated command injection (CVE-2024-3400) that gives root RCE on the perimeter firewall: confirm the version and GlobalProtect config, score it with CVSS, identify CWE-77, judge the pre-auth exposure, upgrade and verify, and assume breach given active exploitation.
Beginner
Framework Patch Triage & Remediation: CVE-2025-29927
Triage a Critical Next.js middleware authorization bypass (CVE-2025-29927): confirm the version, score it with CVSS and see why it is 9.1 despite A:N, identify CWE-285, judge the unauthenticated exposure, upgrade and verify, and know the edge workaround (strip the x-middleware-subrequest header).
Beginner
Framework Patch Triage & Remediation: CVE-2025-55182
Triage a maximum-severity, CISA-KEV-listed React Server Components deserialization RCE (CVE-2025-55182): confirm the package version, score it with CVSS and see why it is 10.0, identify CWE-502, judge the pre-auth exposure, upgrade and verify.
Beginner
Geospatial Server Patch Triage & Remediation: CVE-2024-36401
Triage a Critical, CISA-KEV-listed GeoServer unauthenticated OGC expression RCE (CVE-2024-36401): confirm the version, score it with CVSS, identify CWE-94, judge the pre-auth exposure, upgrade and verify.
Beginner
Graph Database Patch Triage & Remediation: CVE-2024-27348
Triage a Critical, CISA-KEV-listed Apache HugeGraph-Server unauthenticated Gremlin RCE (CVE-2024-27348): confirm the version, score it with CVSS, identify CWE-77, judge the pre-auth exposure, upgrade and verify.
Beginner
Healthcare Integration Engine Patch Triage & Remediation: CVE-2023-43208
Triage a Critical, CISA-KEV-listed NextGen Healthcare Mirth Connect unauthenticated deserialization RCE (CVE-2023-43208): confirm the version, score it with CVSS, identify CWE-502, judge the pre-auth exposure, upgrade and verify.
Beginner
Kernel Patch Triage & Remediation: CVE-2026-31431
Triage a High-severity Linux kernel local-privilege-escalation finding (CVE-2026-31431) on a shared multi-user host: confirm the running kernel, score it with CVSS, judge local exposure, install the branch's fixed release, reboot, and verify the host is clean.
Beginner
Kernel Patch Triage & Remediation: CVE-2026-43284 & CVE-2026-43500
Triage two Linux kernel local-privilege-escalation findings (CVE-2026-43284 and CVE-2026-43500) in one running kernel on a shared host: confirm the kernel, score both with CVSS, judge exposure, then apply the single update that fixes both and verify.
Beginner
LMS Patch Triage & Remediation: CVE-2023-34960
Triage a Critical Chamilo LMS unauthenticated OS command injection (CVE-2023-34960): confirm the version, score it with CVSS, identify CWE-78, judge the pre-auth exposure, upgrade and verify.
Beginner
Print Management Server Patch Triage & Remediation: CVE-2023-27350
Triage a Critical, CISA-KEV-listed PaperCut NG/MF unauthenticated admin bypass to RCE (CVE-2023-27350): confirm the version, score it with CVSS, identify CWE-284, judge the pre-auth exposure, upgrade and verify.
Beginner
Privilege Escalation Patch Triage & Remediation: CVE-2025-32463
Triage a Critical, CISA-KEV-listed sudo --chroot local privilege escalation (CVE-2025-32463) that gives any local user root: confirm the version, score it with CVSS and see why a local bug still scores 9.3 (scope-changed full root), identify CWE-829, judge the shared-host exposure, upgrade and verify.
Beginner
Server Patch Triage & Remediation: CVE-2026-42167
Triage a High-severity ProFTPD SQL-injection finding (CVE-2026-42167) on an internet-facing FTP server: confirm the version, score it with CVSS, understand the conditions it needs, upgrade to the fixed release and verify.
Beginner
Vulnerability Triage & Remediation: CVE-2026-29058
Work a real Critical finding end to end as a Tier-1 analyst: confirm WWBN AVideo CVE-2026-29058 on the host, score it with CVSS, hunt the logs for probe attempts, apply a compensating control, patch to the fixed version, and verify the host is clean.
Beginner
Web App Authentication: Find, Confirm & Fix (Basic)
Hands-on with Authentication Weakness (brute force) (CWE-307) in Acme Accounts's login feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Broken Access Control: Find, Confirm & Fix (Basic)
Hands-on with Broken Access Control (IDOR) (CWE-639) in Acme Billing's invoice viewer (/invoice?id=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Command Injection: Find, Confirm & Fix (Basic)
Hands-on with Command Injection (CWE-78) in Acme Ops Console's host-diagnostics (ping) feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App CSRF: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Request Forgery (CSRF) (CWE-352) in Acme Bank's change-password / money-transfer actions. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Inclusion: Find, Confirm & Fix (Basic)
Hands-on with File Inclusion (LFI/RFI) (CWE-98) in Acme CMS's page renderer (?page=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Upload: Find, Confirm & Fix (Basic)
Hands-on with Unrestricted File Upload (CWE-434) in Acme Portal's avatar/document upload feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SQL Injection: Find, Confirm & Fix (Basic)
Hands-on with SQL Injection (CWE-89) in Acme Store's login / product-search feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SSRF: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Request Forgery (CWE-918) in a web app's URL-fetch feature. Safely reproduce it with an inert training tool (reach an internal service and the cloud metadata endpoint), classify it as SSRF, score it with CVSS, then fix it with a host allowlist that blocks link-local/metadata and disables redirects, and verify.
Beginner
Web App SSTI: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Template Injection (SSTI) (CWE-1336) in Acme Mailer's greeting/personalization feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XSS: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Scripting (XSS) (CWE-79) in Acme Community's comment feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XXE: Find, Confirm & Fix (Basic)
Hands-on with XML External Entity (XXE) (CWE-611) in Acme Invoicing's XML import feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web Application Patch Triage & Remediation: CVE-2025-31131
Triage a High-severity YesWiki path-traversal file-read finding (CVE-2025-31131): confirm the version, score it with CVSS and see why a read-only bug is still High (unauthenticated, scope-changed), identify CWE-22, judge exposure, upgrade and verify, and recognize that exposed secrets must be rotated.
Beginner
Web Server Patch Triage & Remediation: CVE-2026-42945
Triage a High-severity NGINX heap-overflow finding (CVE-2026-42945) on an internet-facing reverse proxy: confirm the version, score it with CVSS and see why AC:H keeps it below Critical, judge exposure, upgrade to the fixed release and verify.
Beginner
Webmail Patch Triage & Remediation: CVE-2025-49113
Triage a Critical, CISA-KEV-listed Roundcube Webmail PHP object-injection RCE (CVE-2025-49113) reachable by any mailbox user: confirm the version, score it with CVSS, identify CWE-502, judge the low-trust authenticated exposure, upgrade and verify.
Beginner
WordPress Plugin Patch Triage & Remediation: CVE-2026-1357
Triage a Critical WPvivid Backup & Migration arbitrary-file-upload finding (CVE-2026-1357) on an internet-facing WordPress site: confirm the plugin version, score it with CVSS and see why it is Critical, identify CWE-434, judge exposure, update to the fixed release and verify.
Intermediate
Authentication Attack Detection & Incident Response
Respond to a Authentication Weakness (brute force) compromise (CWE-307) in Acme Accounts. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Broken Access Control (IDOR) Detection & Incident Response
Respond to a Broken Access Control (IDOR) compromise (CWE-639) in Acme Billing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Command Injection Detection & Incident Response
Respond to a Command Injection compromise (CWE-78) in Acme Ops Console. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Request Forgery Detection & Incident Response
Respond to a Cross-Site Request Forgery (CSRF) compromise (CWE-352) in Acme Bank. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Scripting Detection & Incident Response
Respond to a Cross-Site Scripting (XSS) compromise (CWE-79) in Acme Community. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-27350
Respond to a PaperCut unauthenticated admin bypass to RCE compromise (CVE-2023-27350). Reconstruct the timeline from the access and service logs, see how an unauthenticated request reached the admin console and ran a device script as SYSTEM, find the rogue local account, engineer a detection rule for unauthenticated access to the SetupCompleted admin page, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-34960
Respond to a Chamilo unauthenticated OS command injection compromise (CVE-2023-34960). Reconstruct the timeline from the access and service logs, see how a crafted file name in a SOAP call was passed to a shell, find the PHP web shell, engineer a detection rule for wsConvertPpt calls with shell metacharacters in file_name, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-38646
Respond to a Metabase unauthenticated H2 JDBC RCE compromise (CVE-2023-38646). Reconstruct the timeline from the access and service logs, see how an H2 JDBC connection string executed code at connect time, pre-auth, find the scheduled-task persistence, engineer a detection rule for database-validation requests using the H2 engine with an INIT clause, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-43208
Respond to a Mirth Connect unauthenticated deserialization RCE compromise (CVE-2023-43208). Reconstruct the timeline from the access and service logs, see how an unauthenticated XML body was deserialized into a gadget chain and ran code, find the rogue channel, engineer a detection rule for unauthenticated API bodies containing deserialization gadget markers, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-2044
Respond to a pgAdmin 4 session-traversal pickle-RCE compromise (CVE-2024-2044). Reconstruct the timeline from the access and service logs, see how traversal in the session id loaded an attacker pickle and ran code, find the staged-pickle persistence, engineer a detection rule for traversal, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-23897
Respond to a Jenkins CLI arbitrary-file-read breach (CVE-2024-23897). Reconstruct the timeline from the access and read logs, see how @<path> arguments inlined master.key and credentials.xml, scope the exposure, engineer a detection rule for the @-file pattern, then contain by disabling the CLI feature, eradicate (upgrade + rotate secrets), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-27348
Respond to a HugeGraph unauthenticated Gremlin RCE compromise (CVE-2024-27348). Reconstruct the timeline from the access and service logs, see how a Gremlin query bypassed the sandbox via reflection and ran OS commands, find the rogue cron entry, engineer a detection rule for Gremlin scripts that use reflection to reach Runtime/ProcessBuilder, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-3400
Respond to a PAN-OS GlobalProtect command-injection compromise (CVE-2024-3400). Reconstruct the timeline from the access and service logs, see how shell metacharacters in the SESSID value ran commands as root, find the web-implant persistence, engineer a detection rule for the malicious SESSID pattern, then contain, eradicate, upgrade, verify and report - assuming breach.
Intermediate
Detection Engineering & Incident Response: CVE-2024-36401
Respond to a GeoServer unauthenticated OGC expression RCE compromise (CVE-2024-36401). Reconstruct the timeline from the access and service logs, see how a request property name was evaluated as an expression and ran code, find the JSP web implant, engineer a detection rule for OGC requests whose property reference is an expression (exec()/Runtime), then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-24813
Respond to a Apache Tomcat partial-PUT path-equivalence compromise (CVE-2025-24813). Reconstruct the timeline from the access and work-dir logs, see how the `..;/` trick wrote a session file that FileStore deserialized into RCE, find the staged-session persistence, engineer a detection rule for the malicious PUT pattern, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-29927
Respond to a Next.js middleware-auth-bypass compromise (CVE-2025-29927). Reconstruct the timeline from the access and session logs, see how the x-middleware-subrequest header made middleware skip and exposed /admin, find the backdoor-admin persistence, engineer a detection rule for the bypass header, then contain at the edge, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-31131
Respond to a YesWiki path-traversal data breach (CVE-2025-31131). Reconstruct the timeline from the access and file-read logs, see how squelette traversal read /etc/passwd and the config (DB credentials), scope the exposure, engineer a detection rule for traversal, then contain at the WAF, eradicate (upgrade + rotate the exposed secrets), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-32463
Respond to a sudo --chroot local-privilege-escalation compromise (CVE-2025-32463). Reconstruct the timeline from the sudo auth and activity logs, see how --chroot loaded an attacker nsswitch.conf as root, find the SUID-root backdoor persistence, engineer a detection rule for the chroot option, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-3248
Respond to a Langflow unauthenticated code-injection compromise (CVE-2025-3248). Reconstruct the timeline from the access and service logs, see how /api/v1/validate/code executed posted code with no auth, find the rogue-cron persistence, engineer a detection rule for the code endpoint, then contain, eradicate, upgrade, verify and report - including rotating keys.
Intermediate
Detection Engineering & Incident Response: CVE-2025-49113
Respond to a Roundcube Webmail object-injection compromise (CVE-2025-49113). Reconstruct the timeline from the access and PHP logs, see how a serialized _from value was unserialized into a gadget and ran code, find the web-shell persistence, engineer a detection rule for the serialization markers, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-55182
Respond to a React Server Components deserialization-RCE compromise (CVE-2025-55182). Reconstruct the timeline from the access and execution logs, see how a server-action payload resolved an arbitrary reference and ran as the node process, find the dropped-script persistence, engineer a detection rule for the malicious payload marker, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-68613
Respond to an n8n workflow-expression RCE compromise (CVE-2025-68613). Reconstruct the timeline from the n8n audit and execution logs, see how an expression calling require()/child_process escaped the sandbox and ran as the n8n process, find the attacker's rogue scheduled-workflow persistence, engineer a detection rule for dangerous expressions, then contain by restricting editing, eradicate, upgrade, verify and report - including rotating stored credentials.
Intermediate
Detection Engineering & Incident Response: CVE-2026-10520
Respond to a Ivanti Sentry OS-command-injection compromise (CVE-2026-10520). Reconstruct the timeline from the access and service logs, see how shell metacharacters in a host parameter ran commands as root, find the rogue root-cron persistence, engineer a detection rule for the injection pattern, then contain by restricting the interface, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-1357
Respond to a WPvivid file-upload compromise (CVE-2026-1357). Reconstruct the timeline from the web access log and the plugin upload log, see how filename traversal placed PHP in a web-accessible directory, find the attacker's rogue must-use-plugin persistence, engineer a detection rule for the malicious upload pattern, then contain, eradicate, update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-2329
Respond to an unauthenticated-RCE compromise of a Grandstream IP phone (CVE-2026-2329). Reconstruct the timeline from web and device logs, find the attacker's rogue provisioning persistence, engineer and tune a detection rule for the overflow pattern, then contain, eradicate (firmware + config), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-29058
Respond to a live compromise of a WWBN AVideo host (CVE-2026-29058). Reconstruct the attack timeline from correlated logs, determine impact and find the attacker's persistence, engineer and tune a behavioral detection rule to zero false negatives and false positives, then contain, eradicate, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-31431
Respond to a local privilege-escalation compromise on a shared Linux host (CVE-2026-31431). Reconstruct the timeline from auth and audit logs, find the attacker's sudoers persistence, engineer and tune a behavioral detection rule, then contain, eradicate, patch, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-42167
Respond to a ProFTPD SQL-injection compromise (CVE-2026-42167). Reconstruct the timeline from the FTP auth log and SQL backend log, see how COPY TO PROGRAM turned injection into RCE, find the attacker's cron persistence, engineer a detection rule for malicious usernames, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-42945
Respond to an NGINX worker-crash incident (CVE-2026-42945). Reconstruct the timeline from access and error logs, assess DoS versus RCE using the host ASLR setting, find the vulnerable rewrite config, engineer a detection rule, then contain with a config change, eradicate with an upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-43284 & CVE-2026-43500
Respond to a local privilege-escalation compromise on a host exposed to two related kernel bugs (CVE-2026-43284 and CVE-2026-43500). Reconstruct the timeline, find the attacker's persistence, engineer one detection rule covering both vulnerable subsystems, then contain, eradicate, patch both with one update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-48282
Respond to a Adobe ColdFusion path-traversal-to-RCE compromise (CVE-2026-48282). Reconstruct the timeline from the access and server logs, see how traversal in a template parameter included an attacker .cfm and ran code, find the CFM web-shell persistence, engineer a detection rule for traversal, then contain, eradicate, update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-72898
Respond to a Metabase SQL-injection compromise (CVE-2026-72898). Reconstruct the timeline from the access and database logs, see how /reset_password injection yielded admin, find the backdoor-superuser persistence, engineer a detection rule for the injection pattern, then contain at the WAF, eradicate, upgrade, verify and report - including rotating connected-DB credentials.
Intermediate
File Inclusion Detection & Incident Response
Respond to a File Inclusion (LFI/RFI) compromise (CWE-98) in Acme CMS. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Server-Side Template Injection Detection & Incident Response
Respond to a Server-Side Template Injection (SSTI) compromise (CWE-1336) in Acme Mailer. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SQL Injection Detection & Incident Response
Respond to a SQL Injection compromise (CWE-89) in Acme Store. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SSRF Detection & Incident Response
Respond to a Server-Side Request Forgery compromise (CWE-918) where a web app's URL-fetch feature was aimed at the cloud metadata endpoint and leaked IAM credentials. Reconstruct the timeline from the access and fetch logs, scope the credential exposure, engineer a detection rule for fetches aimed at internal/link-local targets (tuned past a benign look-alike), then contain with an allowlist, rotate the exposed credentials, verify and report.
Intermediate
Unrestricted File Upload Detection & Incident Response
Respond to a Unrestricted File Upload compromise (CWE-434) in Acme Portal. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
XML External Entity Detection & Incident Response
Respond to a XML External Entity (XXE) compromise (CWE-611) in Acme Invoicing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Expert
Root-Cause & Secure Configuration: CVE-2026-42945
Analyze CVE-2026-42945 at the source: understand the NGINX rewrite-module buffer-size miscalculation (CWE-131/122) and the upstream fix, reject a config change that only relocates the trigger, deploy a named-capture config, upgrade, add a WAF control, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Authentication
Fix Authentication Weakness (brute force) (CWE-307) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Broken Access Control
Fix Broken Access Control (IDOR) (CWE-639) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Command Injection
Fix Command Injection (CWE-78) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CSRF
Fix Cross-Site Request Forgery (CSRF) (CWE-352) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-27350
Fix CVE-2023-27350 at the source. Read the vulnerable PaperCut NG/MF code, see how an unauthenticated request reached the admin console and ran a device script as SYSTEM (CWE-284 Improper Access Control), reject a denylist, require an authenticated admin session for every admin page, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-34960
Fix CVE-2023-34960 at the source. Read the vulnerable Chamilo LMS code, see how a crafted file name in a SOAP call was passed to a shell (CWE-78 OS Command Injection), reject a denylist, run the converter with an argument vector (no shell) and validate the file name, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-38646
Fix CVE-2023-38646 at the source. Read the vulnerable Metabase code, see how an H2 JDBC connection string executed code at connect time, pre-auth (CWE-94 Code Injection), reject a denylist, require auth, reject user H2 connections and build the URL from a property allowlist, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-43208
Fix CVE-2023-43208 at the source. Read the vulnerable NextGen Healthcare Mirth Connect code, see how an unauthenticated XML body was deserialized into a gadget chain and ran code (CWE-502 Deserialization of Untrusted Data), reject a denylist, require auth and lock XStream to an allowlist of expected types, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-2044
Fix CVE-2024-2044 at the source. Read the vulnerable pgAdmin 4 session loader, see how the id builds the path (CWE-31) and pickle.load runs code, reject a dot-stripping attempt, validate/canonicalize the path and use json instead of pickle, record session hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-23897
Fix CVE-2024-23897 at the source. Read the vulnerable Jenkins CLI parser, see how the args4j '@' file-expansion feature is left enabled (CWE-27 arbitrary file read), reject a path denylist, disable the feature with setExpandAtFiles(false), record CLI hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-27348
Fix CVE-2024-27348 at the source. Read the vulnerable Apache HugeGraph-Server code, see how a Gremlin query bypassed the sandbox via reflection and ran OS commands (CWE-77 Command Injection), reject a denylist, deny reflection and OS execution in the sandbox (allowlist of safe classes), record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-3400
Fix CVE-2024-3400 at the source. Read the vulnerable PAN-OS GlobalProtect telemetry helper, see how it passes the SESSID value into a shell command run as root (CWE-77), reject a metacharacter denylist, run the helper with an argument vector (execve, no shell) with input validation, restrict exposure, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-36401
Fix CVE-2024-36401 at the source. Read the vulnerable GeoServer code, see how a request property name was evaluated as an expression and ran code (CWE-94 Code Injection), reject a denylist, stop evaluating names as expressions and look them up as literal attributes, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-29927
Fix CVE-2025-29927 at the source. Read the vulnerable Next.js request pipeline, see how it skips middleware based on the client x-middleware-subrequest header (CWE-285), reject a known-value comparison, derive the skip decision from an internal server-set signal and strip the header at the edge, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-31131
Fix CVE-2025-31131 at the source. Read the vulnerable YesWiki template loader, see how the squelette value is concatenated into the file path (CWE-22), reject a dot-stripping attempt, deploy a validated loader (basename + extension allowlist + realpath), add a WAF rule, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-32463
Fix CVE-2025-32463 at the source. Read the vulnerable sudo chroot setup, see how it loads nsswitch.conf from the user-supplied chroot dir while privileged (CWE-829), reject a world-writable check, load config from the trusted real root instead, retire the deprecated chroot feature in sudoers, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-3248
Fix CVE-2025-3248 at the source. Read the vulnerable Langflow /api/v1/validate/code endpoint, see how it has no auth and execs posted code (CWE-306 + code injection), reject a name denylist, require authentication and validate by ast.parse instead of exec, restrict the service, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-49113
Fix CVE-2025-49113 at the source. Read the vulnerable Roundcube Webmail upload.php handler, see how it unserializes the _from value (CWE-502 object injection), reject a string blacklist, validate _from as an identifier instead of unserializing, harden PHP, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-55182
Fix CVE-2025-55182 at the source. Read the vulnerable React Server Components server-action handler, see how it resolves the action reference from the deserialized payload (CWE-502), reject a string denylist, deploy an allowlist/registry lookup with strict decoding, enforce an origin/CSRF check, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-68613
Fix CVE-2025-68613 at the source. Read the vulnerable n8n expression evaluator, see how it compiles user expressions with new Function so require()/process reach the server runtime (CWE-913), reject a string denylist, deploy an isolated-vm sandbox with no Node globals, harden the runtime (restricted editing + least privilege), and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-10520
Fix CVE-2026-10520 at the source. Read the vulnerable Ivanti Sentry report helper, see how it passes the host value into a shell command run as root (CWE-78), reject a metacharacter denylist, run the program with an argument vector (execve, no shell) with input validation, restrict the management interface, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-1357
Fix CVE-2026-1357 at the source. Read the vulnerable WPvivid upload handler, see how the request filename is concatenated into the destination path (CWE-434), reject a dot-stripping attempt, deploy a validated handler (basename + extension allowlist + realpath), deny PHP execution in uploads so an upload cannot reach RCE, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-2329
Fix CVE-2026-2329 at the source. Read the vulnerable Grandstream CGI handler, trace the unauthenticated request parameter to the unbounded copy (CWE-121), reject a strncpy attempt that still overflows, deploy the bounds-checked fix, add a management-VLAN compensating control, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-29058
Fix CVE-2026-29058 at the source. Read the vulnerable AVideo encoder code, trace untrusted input from the request parameter to the OS-command sink, reject a tempting but insufficient blacklist/escapeshellcmd fix, then deploy and prove the correct remediation: allow-list validation plus shell-free execution. Audit and re-scan to verify, and write the pull request.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-42167
Fix CVE-2026-42167 at the source. Read the vulnerable ProFTPD mod_sql handler, see how the username is formatted into the SQL (CWE-89), reject a quote-escaping attempt, deploy a parameterized query, restrict the database role so injection cannot reach RCE, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-48282
Fix CVE-2026-48282 at the source. Read the vulnerable Adobe ColdFusion template-include handler, see how the tpl value is concatenated into the include path (CWE-22) and executed, reject a dot-stripping attempt, deploy a validated handler (getFileFromPath + allowlist + getCanonicalPath), record the lockdown and upload deny-exec, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-72898
Fix CVE-2026-72898 at the source. Read the vulnerable Metabase /reset_password handler, see how it concatenates the email into SQL (CWE-89), reject a quote-stripping attempt, deploy a parameterized query, restrict the app DB role to least privilege, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Inclusion
Fix File Inclusion (LFI/RFI) (CWE-98) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Upload
Fix Unrestricted File Upload (CWE-434) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SQL Injection
Fix SQL Injection (CWE-89) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSRF
Fix Server-Side Request Forgery (CWE-918) at the source. Read the vulnerable URL-fetch handler, see how it fetches any user URL and follows redirects, reject a substring blocklist, and apply the real fix: allowlist the host, resolve it and reject loopback/link-local/private IPs, and disable redirects. Record IMDSv2 + egress hardening and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSTI
Fix Server-Side Template Injection (SSTI) (CWE-1336) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XSS
Fix Cross-Site Scripting (XSS) (CWE-79) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XXE
Fix XML External Entity (XXE) (CWE-611) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Configuration: CVE-2025-24813
Fix CVE-2025-24813 at the deployment. Understand the partial-PUT path-equivalence parsing flaw (CWE-44) and how FileStore session deserialization (CWE-502) turns it into RCE, reject a .jsp extension blacklist, deploy a hardened config (read-only Default Servlet, partial PUT disabled, no FileStore) alongside the upgrade, and verify with audit and vulnscan.
Expert
Root-Cause Analysis & Kernel Hardening: CVE-2026-31431
Analyze CVE-2026-31431 at the source: understand the CWE-669 cross-sphere flaw in the kernel's AF_ALG AEAD interface and the out-of-place upstream fix, then patch and apply defense-in-depth hardening (module blacklist, restricted user namespaces) and verify the posture.
Expert
Root-Cause Analysis & Kernel Hardening: CVE-2026-43284 & CVE-2026-43500
Analyze two related Linux kernel CVEs (CVE-2026-43284 and CVE-2026-43500) at the source: recognize the shared root cause (in-place decryption over shared socket-buffer fragments) across IPsec/ESP and RxRPC, read both upstream fixes, then patch both with one update and apply defense-in-depth hardening for both subsystems, and verify.