Training updates RSS feed

Updates that apply to specific Veracode regions show a region icon. Security Labs is only available in the Commercial region. eLearning is available in all Veracode regions.

September 10, 2026​

Veracode eLearning REST API has reached end of support​

We will no longer update this API or provide technical support.

September 9, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

• OWASP LLM 09: Outdated Answers (Flask)

August 13, 2026​

Date range for eLearning reports​

You can now select a start date of up to one year in the past for an eLearning report.

August 6, 2026​

New Security Labs lessons

OWASP Top 10 for LLM applications​

• OWASP LLM 08: Vectors Without Borders (Flask)

OWASP Top 10:2025 labs​

• OWASP 1: Bad Cookie (Java)

July 8, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

• OWASP LLM 07: Under the Hood (Flask)

Updated eLearning course

The following course is now available with English, Spanish, French, Portuguese, and Chinese captions.

• C/C++ Memory Management Risks and Best Practices

June 30, 2026​

Deprecation notice: Security Labs community edition​

The Security Labs community edition will be deprecated on July 31, 2026.

June 10, 2026​

Security Labs updates

The deprecated OWASP Top 10 (2021) lessons are no longer available. The following lessons have been added.

OWASP Top 10 for LLM applications​

• OWASP LLM 06: The Chaos Creator (Flask)

OWASP Top 10:2025 labs​

• OWASP 1: Loose Lips Sink Servers (Java)

eLearning course updates

The following 33 deprecated courses are no longer available, and certification levels have been updated to include newer courses.

• OWASP 2017
• OWASP Top 10 (2021) (6 courses)
• Secure Coding for .NET (6 courses)
• Secure Coding for Java (6 courses)
• Secure Coding for JavaScript (5 courses)
• Secure Coding for PHP (6 courses)
• Secure Coding for Python (3 courses)

The following courses, when combined with Secure Coding Foundations, replace the deprecated courses. They are now available with English, Spanish, French, Portuguese, and Chinese captions.

• Software Security Awareness - OWASP Top 10:2025
• Secure coding for .NET - OWASP Top 10:2025
• Secure coding for Java - OWASP Top 10:2025
• Secure coding for JavaScript - OWASP Top 10:2025
• Secure coding for PHP - OWASP Top 10:2025
• Secure coding for Python - OWASP Top 10:2025

The following course is now available with English, Spanish, French, Portuguese, and Chinese captions.

• Introduction to PCI DSS for Developers (v4.0.1)

May 6, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

• OWASP LLM 05: The Trust Trap (Flask)

April 21, 2026​

Security Labs – updates to the Get Lesson Progress API​

The updated Get Lesson Progress API:

• Has stack added to the response.
• Shows Not Started when both start_time and end_time are null.
• Has the updatedAfter parameter to support incremental loads.
• Has the excludeNotStarted=true parameter to remove lessons that have not been started.
• Includes updated_on in the response.

April 16, 2026​

Search teams in Security Labs​

In Security Labs, Security Labs administrators and managers can now search teams.

April 8, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

• OWASP LLM 04: Hidden Triggers (Flask)

March 23, 2026​

Security Labs users and teams is integrated with the Veracode Platform​

Security Labs users and teams can now be managed by the Veracode Administrator and the Team Admin from the Veracode Platform. Learning for users and teams in the Veracode Platform is managed from Security Labs. This change involves Veracode authenticating Security Labs users through Veracode IAM (Identity and Access Management).

Customers are migrated to this feature in phases. After migration, Security Labs users sign in to the Veracode Platform and access Security Labs under Security Training. If you wish to enable this feature, please contact support@veracode.com.

March 4, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

• OWASP LLM 03: Code at Your Command (Flask)

New eLearning courses

Secure coding language addendum courses​

Secure coding courses with language examples have been added, to align with the latest OWASP Top 10:2025. Courses that follow the 2021 list will be deprecated in June 2026.

• Software Security Awareness - OWASP Top 10:2025
• Secure coding for .NET - OWASP Top 10:2025
• Secure coding for Java - OWASP Top 10:2025
• Secure coding for JavaScript - OWASP Top 10:2025
• Secure coding for PHP - OWASP Top 10:2025
• Secure coding for Python - OWASP Top 10:2025

March 3, 2026​

Security Labs - URL change and terminology update​

The default URL to access Security Labs has changed from https://securitylabs.veracode.com/ to https://securitylabs.veracode.com/security-labs/. Customers who access Security Labs with a stand‑alone account through their organization’s single sign-on (SSO) should update the Security Labs URL for continued access to Security Labs.

In Security Labs, Teams are now called Organizations, and Roles are called Teams.

February 5, 2026​

New Security Labs lessons

OWASP Top 10 for LLM applications​

• OWASP LLM 01: From Image to Insight (Flask)
• OWASP LLM 02: The Oversharing Assistant (Flask)

January 7, 2026​

After February 2026, the OWASP Top 10 Web Application Security Labs based on the 2021 list will be deprecated. The new OWASP Top 10:2025 labs are now available.

OWASP Top 10 2025 labs​

See the Course Catalog for more details.

• A01 Broken Access Control
• A02 Security Misconfiguration
• A03 Software Supply Chain Failures
• A04 Cryptographic Failures
• A05 Injection
• A06 Insecure Design
• A07 Authentication Failures
• A08 Software or Data Integrity Failures
• A09 Security Logging and Alerting Failures
• A10 Mishandling of Exceptional Conditions

As you can see from the OWASP Top 10:2025 page, there are two new categories in positions A03 and A10. Two new Security Labs lessons in these categories are:

• OWASP 3: Letting Go of the Outdated (Java)
• OWASP 10: Fail Securely (Java)

December 24, 2025​

In-app help in Security Labs​

In-app guidance is now available for creating campaigns and using reporting in Security Labs.

Note: For in-app guidance to function, third-party cookies must be enabled in Chrome, Edge, Firefox, Safari and Internet Explorer 9+.

December 18, 2025​

Obsolete secure coding courses are being deprecated and an updated framework for secure coding training is provided.

Obsolete Secure Coding courses deprecation​

After January 2026, the following Secure Coding courses will be deprecated:

• Secure Coding for .NET
• Secure Coding for Java
• Secure Coding for JavaScript
• Secure Coding for PHP
• Secure Coding for Python

Updated framework for secure coding training​

In the future, secure coding training will require learners to complete all seven courses in Secure Coding Foundations and one of the following OWASP Top 10 courses:

• Secure Coding for .NET - OWASP Top 10 (2021)
• Secure Coding for Java - OWASP Top 10 (2021)
• Secure Coding for JavaScript - OWASP Top 10 (2021)
• Secure Coding for PHP - OWASP Top 10 (2021)
• Secure Coding for Python - OWASP Top 10 (2021)

October 15, 2025​

New eLearning courses

Assessment quiz courses​

Assessment quiz courses based on product learning paths are available in English, Portuguese, and Spanish.

• User and application setup - Skills assessment
• Static Analysis - Skills assessment
• Dynamic Analysis - Skills assessment
• Scan and fix in your IDE - Skills assessment
• SCA agent-based scanning - Skills assessment

Secure coding language addendum courses​

Courses on OWASP Top 10 (2021) are available in English, Portuguese, and Spanish.

• Secure coding for .NET - OWASP Top 10 (2021)
• Secure coding for Java - OWASP Top 10 (2021)
• Secure coding for JavaScript - OWASP Top 10 (2021)
• Secure coding for PHP - OWASP Top 10 (2021)
• Secure coding for Python - OWASP Top 10 (2021)

October 8, 2025​

New Security Labs lessons

OWASP Top 10 2021 labs​

• OWASP 8: Mongo: like SQL, but messier (Java, .NET)
• OWASP 8: User-Provided Users (Java, Node)

September 3, 2025​

New Security Labs lessons

Container Security in Docker - Inventory​

• Scanning

Container Security in Docker - Orchestration​

• Compose
• Secrets
• Swarm mode

August 6, 2025​

New Security Labs lessons

Container Security in Docker - Inventory​

• The Scout
• Distroless images

OWASP Top 10 2021 labs​

• OWASP 8: Sleeping with the enemy (Java)
• OWASP 8: In a Pickle (Node)
• OWASP 8: Deserialization (Node, .NET)

July 2, 2025​

New Security Labs lessons

Container Security in Docker - Inventory​

• ImageTragick
• Content trust

OWASP Top 10 2021 labs​

• OWASP 7: Authentication bypass (.NET, Java)

June 4, 2025​

New Security Labs lessons

Container Security in Docker - Resources​

• Soft limits
• Hard limits

May 7, 2025​

New Security Labs lessons

Container Security in Docker - Resources​

• Cgroups
• Cgroups leak
• The release agent

April 2, 2025​

New Security Labs lessons

Container Security in Docker - Networking​

• NET namespaces
• Attack surface
• Network sockets
• SSH
• Inter-container communication
• iptables

March 5, 2025​

New Veracode branding​

• Veracode has updated the look-and-feel of Security Labs with new branding.

New Security Labs lessons​

Container Security in Docker - Capabilities

• Linux capabilities
• Capabilities in containers
• Security profiles
• Game overlay
• Kernel attack

February 5, 2025​

New Security Labs lessons for Enterprise Edition

Container Security in Docker - Users​

• Cloning users
• Cloning groups
• User namespaces
• Privilege escalation

Container Security in Docker - Virtualization​

• UTS namespaces
• Mount namespaces
• Attack on Beluga
• PID namespaces
• Unmasking Docker
• Runtime attack

New Security Labs lessons for Community Edition

Container Security​

• Cloning users

OWASP Vulnerabilities for APIs​

• One ID to Access All Objects (Java, .NET)

OWASP Vulnerabilities for Web Apps​

• To Protect and To Serve Secure Cookies (Python, .NET, Rails, Go, Node, PHP)

January 8, 2025​

New Security Labs lessons

OWASP Top 10 2021 labs​

• OWASP 2: Insufficient Entropy (.NET, Python)

OWASP API Top 10 2023 labs​

• OWASP API 6: The Great Referral Quest (.NET)
• OWASP API 10: Gift Cards at Risk (.NET)

December 11, 2024​

New Security Labs features include CWE tagging for lessons and code syntax highlighting.

CWE tagging improves lesson assignment​

• Admins can search lessons based on CWE or title.
• Learners can see lessons linked to specific CWEs.

Syntax highlighting improves clarity of code samples​

• Learners see code syntax highlighting that is tailored to programming languages.

December 4, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

• OWASP 2: Insufficient Entropy (Node)

OWASP API Top 10 2023 labs​

• OWASP API 6: The Great Referral Quest (Node)
• OWASP API 7: Retrieval Without Validation (Node)
• OWASP API 7: Retrieval Without Validation (.NET)
• OWASP API 10: Gift Cards at Risk (Node)

November 6, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs and OWASP API Top 10 2023 labs​

Four NEW lessons have been released. This includes upgrading the OWASP API Security Top 10 from 2019 to 2023, and adding lessons for three new categories.

• OWASP 2: Insufficient Entropy (for Java)
• OWASP API 6: The Great Referral Quest (Java)
• OWASP API 7: Retrieval Without Validation (Java)
• OWASP API 10: Gift Cards at Risk (Java)

Lessons will be reorganized to fit into their new position in the OWASP API Security Top 10 (2023) list. An additional More OWASP Vulnerabilities for APIs category was added to include lessons that fall into categories that are no longer in the API Top 10.

September 5, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

• OWASP 1: Redirect Rodeo (Java)
• OWASP 1: Forging User Requests (Java, Go, Rails)

May 1, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

• OWASP 1: Forging User Requests (Python, Flask)

April 29, 2024​

eLearning course updates​

The following 32 courses now have updated cover pages and optional closed captions:

• Secure Coding Foundations (7 courses)
• AppSec Tutorials (11 courses)
• General Security (9 courses)
• Mobile Security (4 courses)
• OWASP Top Ten (2021) (1 course)

April 3, 2024​

New Security Labs lessons

OWASP API Security Top 10 labs​

• OWASP API 6: Bad Design Compromises Security (JavaScript)
• OWASP API 7: Jot Down this Key (JavaScript)
• OWASP API 7: Secret Admin (JavaScript)
• OWASP API 7: eXternal Entity Injection (JavaScript)
• OWASP API 7: XML is Always a Challenge (JavaScript)
• OWASP API 8: Own the Database (JavaScript)
• OWASP API 8: Parameterize All the Things (JavaScript)
• OWASP API 8: Bobby Tables (JavaScript)
• OWASP API 9: Unprotected Deployments (JavaScript)
• OWASP API 10: The Importance of Logging and Monitoring (JavaScript)
• OWASP API 10: Logging in the API Infrastructure (JavaScript)

March 6, 2024​

New Security Labs lessons

OWASP API Security Top 10 labs​

• OWASP API 1: One ID to Access All Objects (JavaScript)
• OWASP API 1: Stronger IDs (JavaScript)
• OWASP API 2: Really, Really Bad Passwords (JavaScript)
• OWASP API 2: Terrible Password (JavaScript)
• OWASP API 3: Bugs in Debug (JavaScript)
• OWASP API 3: Revealing Schemas (JavaScript)
• OWASP API 4: Slow Down (JavaScript)
• OWASP API 4: Brute Force (JavaScript)
• OWASP API 4: Denial of Service (JavaScript)
• OWASP API 5: Neglected Endpoints (JavaScript)

February 7, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

• OWASP 1: Forging User Requests (.NET)

OWASP API Security Top 10 labs​

• OWASP API 10: The Importance of Logging and Monitoring (Java)
• OWASP API 10: Logging in the API Infrastructure (Java)

January 16, 2024​

New Security Labs lesson

OWASP API Security Top 10 labs​

• OWASP API 9: Unprotected Deployments (Java)

Previous updates​

2023 updates​

2022 updates​

2021 updates​

2020 updates​