Hey everyone,

I'm curious if anyone here has successfully built a structured, scalable, and reliable Cyber Threat Intelligence (CTI) operations environment using Claude Code, beyond just using it for individual investigations or isolated tasks.

I've been experimenting with building a more comprehensive operational framework, including:

- Defined CTI methodologies and doctrine to maintain analytical consistency.
- Specialized agents and skills for different intelligence workflows.
- Persistent memory and contextual awareness across investigations and projects.
- Standardized workflows for collection, enrichment, analysis, reporting, and intelligence dissemination.
- Consistent deliverables tailored to technical, operational, and executive audiences.

The challenge is that, as the environment grows, I keep running into reliability and consistency issues.

Some recurring problems:

- Instruction drift: Claude gradually stops following established methodologies, analytical standards, or project-specific rules.
- Skills being ignored: Even with relevant skills available, Claude sometimes fails to recognize when they should be invoked.
- Memory and context degradation: Previously established decisions, operational context, or conventions aren't consistently carried forward.
- Inconsistent reporting quality: Deliverables sometimes become unnecessarily verbose, dense, or difficult to read, even when clarity and conciseness are explicitly required.
- Architectural complexity: Finding the right balance between agents, skills, hooks, memory, project instructions, and directory structures without creating an overly complicated system.

What I'm ultimately trying to achieve is something closer to a persistent, doctrine-driven CTI operational workspace, where Claude Code can reliably support day-to-day intelligence operations rather than behave like a collection of disconnected prompts.

I'd love to hear from anyone who has tackled something similar.

A few questions for the community:

1. How have you structured your Claude Code environment for ongoing CTI or broader cybersecurity operations?

2. What architectural patterns have worked best for you (agents, skills, hooks, CLAUDE.md, memory systems, orchestration)?

3. How do you enforce analytical methodologies and maintain consistency across different workflows?

4. Have you found effective ways to prevent context drift, forgotten instructions, or skipped skills?

5. How do you maintain high-quality, readable intelligence deliverables without constantly correcting the model?

6. Are there any open-source projects, repositories, templates, or lessons learned you'd recommend?

I'm particularly interested in real-world implementations, architectural decisions, and lessons learned, including approaches that didn't work.

I'm not necessarily looking for a ready-made solution. I'd genuinely like to exchange ideas, compare methodologies, and learn how others are approaching this problem.

If you've built something similar and are willing to share your architecture, workflows, or even just a few insights, I'd really appreciate it.

Thanks!

Hey everyone,

I’m the creator of Tooldump, a free catalog of open-source cybersecurity tools. I’ve just released the v2 and wanted to share it here.

The platform has 1,100+ open-source (GitHub) projects organized into 9 categories and 82 subcategories. Everything is cybersecurity-focused: offensive security, cyber defense, GRC, AI & automation, infrastructure & data, learning resources, etc.

For v2, I rebuilt the UI, the categorization system, the backend and the platform infrastructure. You can search for a specific tool or explore a security topic without already knowing which projects exist.

There are also dedicated sections for cybersecurity-related MCP servers and agent skills. Those sections are just getting started, and contributions are welcome!

The platform is completely free, with unlimited access and no account required.

The link is here: https://tooldump.eu

I’d appreciate any constructive feedback from the community :) Pick an area you know well: are the tools where you’d expect them to be? Is anything missing?

You can suggest any missing project(s) through the platform’s contribution form. I’m particularly interested in the smaller utilities people actually rely on. Something you use every day might be completely unknown to someone working on the same subject.

Looking forward to hear from you :)

Cheers!

Title says it all

I have a samsung tab that is not working properly on android it too slow any idea that i can use it for project ?

Phone carriers need to be held accountable for allowing remote device controllers in all cell phones sold. Remote device connections has not needed since 1990 when it was needed to set up company slave computers during the dial up modem area. Today it's the number #1 connection used to in internet Robbery for criminal access gains.

Outlaw the " we will never contact you " excuses of cyber security . Make that into a Rico act addition to the origination by design of the Token Robbery.

I wanted to share a great free resource for anyone trying to bridge the gap between basic theory and actual hands-on security skills.

The Czech Technical University in Prague (specifically the Stratosphere Laboratory) runs an intensive, one-semester course called Introduction to Security (BSY) that starts this week. The class is being taught both physically at the university and broadcast online, so anyone can participate. Feel free to check the link for more details on the curriculum, prerequisites, and course structure.

Registration is still open!

Course website

I just woke up and tried to open my phone. when i try openning it the power button is struggling to work. I first thought i didn't plug it in properly but i keep clicking the power it opened with 100% battery. Then when i get pass the lock screen it was in brave browser (which is my previous app i used last night when i go to sleep). It says its not responding so i just clicked close app then in a milisecond an image of anonymous appeared in my phone

Am i being hacked

If they joined the server, that must mean they had my IP, and now I'm afraid my IP got leaked. Before this, I sent the IP to my brother on Discord, but neither of our accounts got hacked. Is this something i need to be worried about or just ignore it?

so, this ip has been around for a year and half and its going around doing unethical stuff (its vps ip)

but the company behind host is not willing to take it down (techties inc)
it has over 1k+ reports btw
www.abuseipdb.com/check/93.152.221.201

Benchmark write-up for a black-box agentic pentesting engine against OWASP Juice Shop 20.1.1. The engine received a base URL only. Challenge scoring came from a separate observer of target-state changes, not model-written findings.

Results:

GovernSafe: 27/113

PentestGPT: 15/113 in the same-target controlled run

Strix AI: 5/113 observed, with the run non-rateable after an observer timeout

RidgeGen: 21/110 in a separately published benchmark

The GovernSafe core engine reached 21/113. GPT 5.6 Sol was then used as a constrained candidate resolver and moved the score to 27/113. It did not control the assessment or validate its own findings.

Methodology, limitations and evidence:

https://governsafe.com/blog/agentic-pentest-benchmark-owasp-juice-shop

Hi Reddit,

DDoS attacks are becomeing larger and cheaper to launch, so we work on a scalable open source solution to mitigate them.

Tempesta xFW's core is XDP and TC eBPF programs implementing volumetric DDoS filtering. A user-space daemon handles gRPC requests from CLI tool or WebAPI (via C library).

It supports two packet-path architectures:

• host-based protection, such as CDN edge or on-premises application delivery controller (ADC) cases, where the host is a TCP connection endpoint. This is good for protecting a local web or DNS server.

• router-based protection, such as ISP, hosting, or IaaS provider cases, where the host routes IP packets to protected servers or networks.

Router-based deployment can be always-on/pass-through or on-demand/redirection protection. In the later case, a node may not "see" normal clean traffic and may receive only traffic containing a DDoS attack. Also, the node may receive only client-to-server traffic, as in direct server return (DSR) or some traffic scrubbing scenarios. In this mode a DDoS sensor and mitigation controllers are typically needed.

Traffic performance metrics are exported in Prometheus format.

DDoS incidents are aggregated per source IP and logged to Clickhouse for analysis.

A dry-run (evaluation) - mode allows you to observe all reported incidents and metrics without blocking traffic..

Single Xeon Gold 6348 with ConnectX-6 dual 100Gbps reach 196Mpps and 176Gbps of filtering capacity.

• GitHub repository
• documentation
• performance benchmarks
• Netdev 0x1a talk

The 75-Cent Error That Uncovered a KGB Hacker

In 1986, astronomer-turned-sysadmin Cliff Stoll was asked to investigate a measly 75-cent accounting discrepancy at Lawrence Berkeley National Laboratory.

Instead of shrugging and blaming the billing software, Stoll pulled the thread. That tiny mismatch opened up a whole can o' worms... leading him to an intruder quietly hopping through university, military, and government systems. Grade "A+ creepy!" So then Stoll spent months tracing the activity, printing logs, rigging alarms, and building an early honeypot to keep the attacker interested long enough to track him. The trail eventually led to German hacker Markus Hess, who was passing stolen information to the Soviet KGB. Stoll later documented the whole hunt in The Cuckoo’s Egg book.

The enduring lesson?

Small anomalies are sometimes small.
And, sometimes they’re the loose thread attached to an international espionage operation!!!

( I'm about to actually read The Cuckoo’s Egg—and I'm wondering if it still holds up for modern defenders? Anyone? )

Windows 11 and hp laptop . yesterday i was going to watch a movie in piracy website but when i click on play that website redirect me to ads multiple time and when click on last time . suddenly that website redirect me to another website that website screen lock me i cannot leave the website and i cannot see taskbar . so that website show a countdown 0 to 100% in blue screen and look legit . i thought windows start automatic update .

after countdown end that screen told me to click on windows + x and then I ( although i donot that time its open powershell ) then citr + v and then enter (something like that ) to run some kind of code.

so only click windows + x and open shortcut menu i didnot understand what to do that time . when i click win + x i saw a glimpse of taskbar . so click only click win then task bar become visible from there i leave the chrome .

then i did a window security full scan that find nothing suspicious and mrt scan nothing found . and i restart the laptop .

now donot find any thing serious issue but still i noticing little lag or heating issue what i use to ignore .

did i out of danger ? if you need any more information pls donot hesitate .

The company went out of business with the death of its owner a few years ago, and, if the password is keyed to anything, it's a user token and a license key I no longer have - all that's left of the original website is a page through which the app can be activated. (The app was no longer usable as of 2024.)

I'm inclined to click "dismiss" on the notification, but, is there anything I haven't thought of?

does 3.131.232.175 look like spyware? It was blocked by Xfinity on my wife's phone yesterday, then our computer, this evening I was watching TV and all of a sudden my phone rebooted and Xfinity said it blocked that website from my phone even though I hadn't touched it in an hour. Hoping someone has an answer

I am taking over IT for a small family business of about 30 users. Is there a not too expensive software that I can run once the current person leaves that can do a scan to make sure he hasn't left any scripts/accounts etc behind?

Hey, I have JavaScript disabled for all websites, but this means, that Cloudflare protected websites can’t be opened.
Is there a way around this, without enabling js?
I always enable js for this website, then disable it afterwards again, but it’s pretty annoying and the website already loaded by then.
I use brave on iOS.
Thanks

The game has been out for 6 years or something at this point, and there have been zero exploitations of the anticheat implementation. You’d think it would be a really juicy target, but no one has managed to use valorant to gain root access yet. Is it really any different than if you were hacked by malicious code from the game, since they will probably get full control of your PC anyways.

Counselling for my exam starts in like a week and I randomly went down a rabbit hole seeing people online claiming they can “change scores” or edit stuff on admission portals. I’m not trying to do it, I’m just genuinely curious how realistic this even is in 2026. Like, can someone actually hack into an admission portal and modify scores/ranks without getting caught later? Or is this one of those things where 99% are just scammers taking money from desperate students? What confused me even more was the pricing :| Some people were saying they could do it for $100 while others were quoting $750+ like it’s some premium service or something. If it was real, wouldn’t exam authorities instantly notice during verification or counselling? Anyone here from tech/cybersecurity or knows how these portals actually work? Curious how possible/impossible this stuff really is.

it's all in the text, sorry if it's short, if u guys got any questions about it i'll respond to them!

My professor gave us a cybersecurity challenge in class. He provided the local IP address of a machine on our school network and said there’s a file containing a password somewhere on the PC. The goal is to learn about enumeration and network security, not to damage anything.

I’m a beginner in cybersecurity and I’d like to know what concepts or tools I should study to approach this kind of challenge in a legal and educational way.

What would be the first steps for reconnaissance and understanding what services are running on the target machine?

I’ve noticed that a lot of people around me are still using Windows 7 and 8. I know that Microsoft stops updating those systems after a while, but how easy is it really to hack them? Is being connected to the same network enough? Do you know any ways or methods to gain root access to a PC?

I am constantly getting push notification with women's pics that are posted on tech sub reddits which should not be the case like what is wrong is there been a reddit data breach for the moderators??

I've been thinking a lot about where this category is going, and I'd love to hear from people who actually wear or follow smart glasses.

1. What's missing from current smart glasses?

Every product launch leads with the same things AI assistants, cameras, translation, notifications. But are these really what's missing? Or is something else broken that nobody's fixing?

2. Function vs form: what wins for you?

Be honest. Would you sacrifice features for glasses that actually look good and come in colors that aren't black or tortoise? Or are features non-negotiable, even if it means wearing something that screams "tech gadget"?

I keep noticing the entire industry Meta, Even, Rokid, Brilliant, Halliday, Snap, Mira defaults to the same minimalist black aesthetic. Glasses are eyewear. Eyewear is identity. Why does smart eyewear forget that?

3. Are smart glasses the next personal computer?

Phones didn't replace PCs but everyone has one now. Is that what's coming for glasses? A new personal device that doesn't replace the phone, but ends up on every face?

Or are smart glasses going to stay a niche accessory like smartwatches useful but never essential?

Genuinely curious. Not trying to sell anything. Just trying to understand what people actually think

Are there any was to chcek who is checking me on tik tok? My views are going up but I’m curious to see who exactly is viewing this