Your BIOS is out of sight, out of mind: and that's exactly where attackers hide. Learn firmware security, SPI flash, SMM & how to RTFM like a pro. Architecture 4001: x86-64 Intel Firmware Attack & Defense by @xenokovah.bsky.social is at ost2.fyi/Arch4001

Every @opensectraining.bsky.social training I’ve taken has had an amazing level of quality.

Your CPU speaks assembly. Shouldn't you? Master x86-64 with the most common instructions and unlock reverse engineering, exploit dev & OS internals. ~28h on average (not counting the final lab). Take Architecture 1001: x86-64 Assembly ost2.fyi/Arch1001 by @XenoKovah today for mad skillz tomorrow!

If you're serious about reverse engineering, you need to master a powerful debugger. Dbg1103 walks you through Binary Ninja's debugger hands-on, so you can hit the ground running on real targets. ost2.fyi/Dbg1103 by Xusheng Li

Why would anyone learn about Windows kernel exploitation?! Take ost2.fyi/Exp4011 by Cedric Halbronn and learn about Windows kernel internals, vulnerability exploitation engineering, heap grooming, race condition, UAF, and what it takes to find your own exploitation primitives!

📣New OST2 class release!📣 The TPM trilogy is complete! "TC1103: Advanced TPM usage" by Dimi Tomov is now public at ost2.fyi/TC1103! Learn about advanced TPM policy access controls, protecting external keys in a TPM, implementing maximum security TPM-backed FDE, and more!

Why spend time on fake vulnerabilities at a CTF when you could learn 38 *real* CVEs? Take "C-Family Software Implementation Vulnerabilities " ost2.fyi/Vulns1001 by @xenokovah.bsky.social and Kc Udonsi today!

Why read about TPM 2.0 in a spec when you can drive it with Python? 🐍 TC2202 teaches real-world TPM programming with tpm2-pytss, taught by its author, Bill Roberts. Hardware-backed crypto, hands-on labs, no fluff. ost2.fyi/TC2202

Move from basic fuzzing to a high-performance workflow. Fuzzing 1001 ost2.fyi/Fuzz1001 bridges the gap between theory and practical research. Master AFL++, PCGUARD, LTO, and ASAN using real CVEs from Xpdf and tcpdump.

Tired of guessing inputs? Let the computer do the work! Learn about symbolic execution from @barbieauglend.bsky.social in "Reverse Engineering 3201" ost2.fyi/RE3201 and use SMT solvers to find the exact inputs to reach vulnerable code. Stop guessing, start solving!

We're happy to say that we're now over 34k students at OST2! 🙌🥳🚀

But any topic is welcomed and encouraged! HMU at that email below if you're interested in getting funded to create a class and make it freely available to the world!

We're in discussion to form a partnership with the UEFI Forum. But as part of that we need to propose classes that can be taught on the topics they're involved with. Things like UEFI Measured Boot in particular would make a lot of sense now that we have robust TPM classes at OST2.

OST2 is putting out a request for proposals for an opportunity to be funded to create classes on UEFI and/or ACPI. If you are interested, please reach out to teach🌀ost2.fyi with a proposed class syllabus. ost2.fyi/Training-RFP...

Final call for beta testers! The class will begin later today!

We are happy to announce that AMI has become a 🥇Gold-level sponsor of #OST2! Learn about their work creating firmware across the industry here: ost2.fyi/Sponsor_AMI_SM

Our Trusted Computing "Advanced TPM usage" class will begin this week. Sign up below.

🧵Like TC1101 & TC1102, TC1103 has the goal of helping developers get bootstrapped on using TPMs more quickly than if they were to just rely on reading the spec or API documents alone.

📢Call for beta testers!📢 forms.gle/9QgwVSstXi7n... The beta for Trusted Computing 1103: Advanced TPM Usage will start Jan 16th. It will take ~7 hours to complete. Sign up above if you're interested in participating. (Note: ost2.fyi/TC1101 & ost2.fyi/TC1102 are strongly recommended prerequisites.)

In 2026 we will be fundraising to add a gamification plugin to our Open edX servers. This will add a leaderboard for learners, and provide a new way to track your sub-class-granularity skills that you're picking up on the site. To help early, donate here: www.every.org/ost2/f/lets-...

We're always looking for more sponsors for #OST2! If your company wants to support creating better security engineers everywhere in the world, get in touch!

We've got a decent number of instructors in the queue to create new classes in 2026 too, but we can always use more! Classes are a significant investment of time, but they also pay off in a significant way for the number of people you will help over many years!

#OST2 has a ton of material that's relevant to RE. And our ost2.fyi/Dbg1101 introduction to IDA as a debugger class instructor, Christina Johns, is working on the "Reverse Engineering 2001: Introductory Static Analysis of C-based programs" class, which will unlock opportunities for many new classes!

🧵A special thanks to the instructors who stepped up in 2025 to release new classes: * Francesco Pollicino - Fuzzing 1001: Introductory white-box fuzzing with AFL++ - ost2.fyi/Fuzz1001 ...

And also thanks to our Gold Sponsors, 3mdeb, Binarly @binarly.bsky.social, Dark Mentor @darkmentor.com, Hex-Rays @hex-rays.bsky.social, NCCGroup @nccgroupinfosec.bsky.social ...

We also want to give another shout-out to our Partner, Trusted Computing Group for helping to fund classes about how to build secure systems.

A sincere thank you to everyone who donated to #OST2 as an individual in 2025(especially those who used corporate non-profit donation matching)! Your donations go directly to instructors as an honorarium, and show them that you value what they do for OST2 and you want them to keep helping the world!

We are happy to announce that Hex-Rays @hex-rays.bsky.social, makers of IDA, have become a 🥇Gold-level sponsor of #OST2! Learn all the latest about their software reverse engineering tools here: ost2.fyi/Sponsor_HexR...

While we've had an overwhelming turn out in registration for this class, we still wanted to remind people that there's still time to sign up; since our beta classes are when the instructor is actively watching the forums and responding to feedback.

Periodic call for volunteers: We're looking for classes on Apple ecosystem security. E.g. OS internals, binary formats, malware analysis, vulnerability hunting, etc. If you're interested in sharing what you know, reach out at teach🌀ost2.fyi

📢Call for beta testers!📢 The "Architecture 1901: From zero to QEMU - A Gentle introduction to emulators from the ground up!" course by Antonio Nappa @jeppojeps.bsky.social will begin November 28th. Sign up here: forms.gle/LUXaThn4YSYS...

This year @binarly.bsky.social has also expanded their sponsorship to the creation of a new #OST2 Firmware Security Learning Path! ost2.fyi/OST2_LP_FWSE...

We are happy to announce that @binarly.bsky.social has renewed their 🥇Gold-level sponsorship of #OST2! Learn more about what they do in firmware & supply chain security here: ost2.fyi/Sponsor_Bina...

Periodic call for volunteers: We're looking for someone to teach classes on stealth malware, such as rootkits, bootkits, and other security-evading software.

We've officially had our 31337th student join at OST2! We're waiting to hear back to see if the lucky registrant wants to be publicly lauded for their random achievement or not ;)

🧵For those who are curious about the completion time distribution during the beta of my #OST2 BT2222 class, here it is. The average completion time was 8h25m, the median was 8h10m, the min was 3h50m, and the max was 15h22m

🙌We're happy to announce OST2 now has over 31k students registered! 🥳 By the time we noticed we crossed the 30k mark, we were already at 30.5, so we figured we'd wait for 31k, which is now!🎉 👏Kudos to all the students taking and finishing classes!👏

We have made Francesco Pollicino's "Fuzzing 1001: Introductory Fuzzing" class playlist public here: www.youtube.com/playlist?lis... for those who'd like to download the videos for offline consumption.

🧵I made a structural update to the Blue2thprinting #OST2 class today: The previous class was structured like "A:B:[C:D:E]:F:G" where F & G were collecting your own data, and [C-E] were understanding what Tell_Me_Everything.py was trying to tell you about the analyzed data…

With the release of ost2.fyi/BT2222, we have posted a brand new OST2 Bluetooth Learning Path which shows future classes that are planned, as well as classes which we need volunteers for. Freshly updated today: ost2.fyi/OST2_LP_Blue...

The "Trusted Computing 1102: Intermediate Trusted Platform Module (TPM) usage" ost2.fyi/TC2202 class release has updated 3 #OST2 learning paths Secure Software Design & Implementation - ost2.fyi/OST2_LP_SecD... System Security - ost2.fyi/OST2_LP_SysS... Windows Security - ost2.fyi/OST2_LP_Wind...

📣"Trusted Computing 2202: TPM 2.0 Programming using Python and the tpm2-pytss libraries" by Bill Roberts is now released!📣 ost2.fyi/TC2202 This course provides a comprehensive introduction to Trusted Platform Module (TPM) 2.0 programming using the Python-based tpm2-pytss library.

Periodic call for volunteers: we've got a deep slate of Bluetooth classes on the horizon, but we need classes on other wireless protocols. If you'd be interested in teaching a class on satellite, cell, WiFi, Zigbee, LoRa, Thread, etc, let us know at teach🌀ost2.fyi

If anyone from the EU would be interested in helping get #OST2 classes added to digital-skills-jobs.europa.eu/en/cyber-ski..., please reach out

🧵I originally started working on Blue2thprinting to try and figure out where @veronicakovah.bsky.social's over-the-air exploits against Texas Instruments & Silicon Labs (darkmentor.com/publication/...) applied...

📣"Bluetooth 2222: Bluetooth reconnaissance with Blue2thprinting" is now released!📣 ost2.fyi/BT2222 This class teaches you about the 30+ data types that the Blue2thprinting software can collect for when you're trying to determine what a device is, and whether it has any known vulnerabilities.

Are you making your own luck, by taking (and finishing) OST2 classes? ost2.fyi/Learning-Pat...

If you, like me, are curious about the thousands of BT devices that are secretly making noise around us every day (and whether they’re vulnerable to exploitation), then this is the class for you. You can register here: forms.gle/MncQkVAL8Laq...

The videos came back early so the class has begun early! As a reminder, betas are perhaps the best time to participate, because it’s the only time I’m actively checking the forums multiple times per day and quickly fixing material if needed