In 1993, Scott Chasin created Bugtraq as a place for full disclosure – a
mailing list where security researchers could publish vulnerabilities
openly, without gatekeepers, without politics. For over a decade, it was
the heartbeat of vulnerability research. If something mattered in
security, it was on Bugtraq first.
Then it went quiet.
The domain changed hands through a chain of acquisitions, and somewhere
along the way, Bugtraq stopped being Bugtraq. The archives went dark.
The list went silent. A generation of researchers grew up without it.
Today, we bring it back.
I have acquired securityfocus.com and the Bugtraq name. Not to build a
museum – to restart the conversation. The mission is unchanged: full
disclosure, researcher-first, no corporate filter.
The old archives, sourced from community copies of what was always
public mailing list traffic, will be preserved and made accessible
separately.
This list is bugtraq@securityfocus.com. Same address. Same purpose. New era.
If you find vulnerabilities, disclose them here.
If you have opinions on how disclosure should work in 2026, share them here.
If you remember what Bugtraq was – help us make it that again.
After more than thirty years of cybersecurity, we are losing our
history. Exploits, techniques, and in-depth analyses that shaped this
field are disappearing – scattered across dead links, defunct forums,
and servers nobody maintains. Hacker history is fading, and it matters.
In an age where AI can produce knowledge and disinformation at an
unprecedented rate, preserving what was actually true, what actually
worked, and who actually did the work becomes more important than ever.
Posting on this list means preservation for the ages. If your work is
worth archiving, post it here.
Welcome back.
Post something.
