2026

October is Cybersecurity Awareness Month, and Citrix just handed attackers a gift. Three zero-days in NetScaler ADC and Gateway — exploited in the wild before patches existed, chained together for persistent access, and added to CISA’s Known Exploited Vulnerabilities catalog within days of disclosure. If your organization runs a customer-managed NetScaler appliance, this one isn’t theoretical. Here’s the full breakdown: what happened, how the attack chain worked, and what red teamers and defenders need to know right now. ...

This article is written from 14+ years of offensive security practice. Some links are affiliate links that help keep this site running — I only recommend tools and services I’d use myself. Kali Linux comes loaded with over 600 security tools. If you’re new to penetration testing, that’s not empowering — that’s paralyzing. Here’s the honest truth: working pentesters don’t use most of what’s installed. They use a tight core of tools extremely well, and add specialized ones when a specific engagement calls for it. The practitioners who get hired aren’t the ones who can name every tool — they’re the ones who can actually use ten of them. ...

OffSec just did something interesting. The company behind OSCP - arguably the most respected hands-on certification in offensive security - has turned its methodology toward AI systems with a new certification: OSAI (OffSec AI Red Teamer). The timing makes sense. Organizations are deploying LLMs, AI agents, and machine learning pipelines at a pace that’s outrunning their security teams’ ability to test them. Traditional pentesting methodology wasn’t built for this. OSAI is OffSec’s answer to that gap. ...