Bugtraq

Bugtraq was founded on November 5, 1993, by Scott Chasin, created in response to what he and early subscribers saw as the failings of the existing Internet security infrastructure of the time, particularly the slow, filtered vulnerability-handling model used by CERT/CC. It quickly grew into the flagship venue of the emerging full-disclosure movement, operating on the policy of publishing vulnerabilities regardless of vendor response. On-topic traffic included new vulnerability write-ups, vendor security announcements, exploitation techniques, and fixes, open to researchers, sysadmins, and vendors alike.

Origins and Growth

The list moved to Brown University's NetSpace Project around 1995 and came under the stewardship of Elias Levy, known online as Aleph One, from June 14, 1996 until he stepped down on October 15, 2001. Levy later described the environment that shaped the list's mission in terms of vendors not producing patches on their own, leaving the list's focus on pushing fixes for software companies weren't otherwise fixing (this framing is a paraphrase reported secondhand rather than a verified verbatim quotation). Under his moderation Bugtraq became the internet's central clearinghouse for vulnerability disclosure, feeding what became the Bugtraq ID (BID) vulnerability database and, later, tens of thousands of cross-references in the CVE/NVD system. David Mirza Ahmad succeeded Levy as moderator and stepped down around February 23, 2006, with Symantec staff moderating afterward.

Corporate Ownership and Decline

In July 1999 the list became the property of SecurityFocus, the company Levy co-founded, which Symantec acquired in full on August 6, 2002 — a sale that critics said compromised the list's independent, adversarial spirit, and which contributed to the creation of a rival Full-Disclosure mailing list around 2002 as an alternative for people who felt Bugtraq had changed for the worse. Symantec's enterprise security business, including SecurityFocus, later passed to Broadcom (2019) and then to Accenture Security, which completed its acquisition on April 30, 2020.

Shutdown and Reported Revival

Symantec is reported to have stopped approving new posts to Bugtraq around February 24, 2020, and in January 2021 its owner announced the list's discontinuation, citing deprioritized resources; a possible reversal was floated shortly afterward, but the exact dates and sequence of these announcements are inconsistently reported across secondary sources and should be treated as approximate. The list remained largely dormant for several years. In early August 2026, security researcher Jonathan Brossard ("endrazine") — a long-established figure in offensive security research — was reported by Wikipedia's edit history, at least one security-news outlet, and wire syndication to have acquired the SecurityFocus/Bugtraq name and relaunched the list at DEF CON 34 in Las Vegas as an independently operated, community-driven platform, with a stated philosophy that the community, not the platform operator, decides what the list becomes. As of this writing, that relaunch has not been independently confirmed by primary security trade press and should be read as reported rather than fully verified.

Timeline

• 1993-11-05Scott Chasin creates Bugtraq in response to perceived failings of existing vulnerability-handling infrastructure, particularly CERT/CC.
• 1995List moves to Brown University's NetSpace Project.
• 1996-06-14Elias Levy (Aleph One) becomes moderator of Bugtraq.
• 1999-07Bugtraq becomes the property of SecurityFocus.
• 2001-10-15Elias Levy steps down as Bugtraq moderator.
• 2002-08-06Symantec completes its acquisition of SecurityFocus, and with it Bugtraq.
• 2002A rival Full-Disclosure mailing list is created, partly by people who felt Bugtraq had changed for the worse after the Symantec sale.
• 2006-02-23David Mirza Ahmad steps down as Bugtraq moderator; Symantec staff moderate afterward.
• 2019Broadcom acquires Symantec's enterprise security business, including SecurityFocus.
• 2020-02-24Symantec reportedly stops approving new posts to Bugtraq.
• 2020-04-30Accenture Security completes acquisition of Symantec's Cybersecurity Services, including SecurityFocus/Bugtraq.
• 2021-01Owner reportedly announces discontinuation of the Bugtraq mailing list, citing deprioritized resources; exact date and a possible reversal are inconsistently sourced.
• 2026-08-06Jonathan Brossard reportedly announces acquisition of the SecurityFocus and Bugtraq name (per Wikipedia edit history and wire syndication; not yet confirmed by primary security trade press).
• 2026-08-07Bugtraq is reported to relaunch as an independently operated, community-driven mailing list at DEF CON 34 in Las Vegas.