Packet Storm Security

Packet Storm Security is one of the internet's oldest continuously operating archives of exploit code, security advisories, whitepapers, and open-source security tools. According to Wikipedia's summary of the site's history, it was launched in 1998 by Ken Williams as an information security resource offering "computer security tools, exploits, and security advisories" to the public.

Early Turbulence: Harvard, Antionline, and Securify

The site's early years were unstable. Per a July 2001 report by The Register, Packet Storm was at one point hosted at Harvard University, but was shut down there in the summer of 1999 after John "JP" Vranesevich of the rival site Antionline complained to Harvard's administration about the legal risk of hosting exploit code. The site subsequently moved to hosting by the security company Securify, which reportedly hoped to eventually monetize the archive; that arrangement did not prove profitable and Securify eventually discontinued hosting it. Separately, a New York Times article by Peter Wayner, dated August 17, 1999 and titled "Security Firm To Revive Computer-Defense Site," and Wikipedia's account both describe a 1999 sale of the site by Williams to the security/risk-consulting firm Kroll O'Gara. The exact relationship between the Kroll O'Gara transaction and the Securify hosting arrangement described by The Register is not fully reconciled across the available sources and should be treated as an area of some ambiguity rather than a settled timeline.

Return to the Community and Relaunch

Per Wikipedia, the site was "given back to the security community" shortly after 2000. The Register reported on July 16, 2001 that Packet Storm was "back up on a new domain" (packetstormsecurity.org), from which point it operated on a not-for-profit, volunteer-run basis with no corporate ownership, comparable in governance to other independent security archives such as Attrition.org.

2010s Activity

While under Kroll O'Gara's ownership, the site reportedly awarded a $10,000 whitepaper-contest prize to the researcher known as Mixter for work on mitigating distributed denial-of-service attacks, according to Wikipedia. In January 2013, per contemporaneous coverage in The Register and V3.co.uk, Packet Storm launched a bug-bounty program offering up to $7,000 to purchase working exploits for community testing and analysis. In June 2013, Packet Storm researchers collaborated on testing related to Facebook's "shadow profile" data-leak disclosure, with their additional analysis reportedly finding that Facebook's publicly stated impact figures were inaccurate — coverage of this appeared in ZDNet, TechCrunch, the Huffington Post, and other outlets cited by Wikipedia.

Current Status

The organization currently operates as Packet Storm Security, LLC, governed by California law per its Terms of Service (last updated September 12, 2025). Its legacy domain, packetstormsecurity.com, now redirects (HTTP 301) to packetstorm.news, which serves as the primary current domain; the site's official about page describes it as an information security archive with roughly three decades of operating history, self-describing its ethos as "Sharing is caring" and citing coverage in "Webster's Hacker Dictionary" and other security literature. The precise date of the packetstormsecurity.com-to-packetstorm.news domain transition could not be independently verified and is not covered in the sources consulted.

Timeline

• 1998Site launched by Ken Williams as an information security archive of exploits, tools, and advisories.
• 1999Hosted at Harvard University; shut down there in summer 1999 after a complaint from Antionline's John "JP" Vranesevich.
• 1999-08-17The New York Times publishes "Security Firm To Revive Computer-Defense Site" by Peter Wayner, describing a security firm's involvement in reviving the site; Wikipedia describes this period as Ken Williams selling the site to Kroll O'Gara.
• 1999Site hosted by security company Securify, an arrangement that did not become profitable and was later discontinued (per The Register).
• 2000Site reportedly "given back to the security community" (per Wikipedia), unverified in independent detail.
• 2001-07-16The Register reports Packet Storm has relaunched at a new domain (packetstormsecurity.org) on a not-for-profit, independently run basis.
• 2013-01Launches a bug bounty program offering up to $7,000 to purchase working exploits for community testing, per The Register and V3.co.uk.
• 2013-06Involved in testing and disclosure around Facebook's shadow-profile data leak, reportedly finding Facebook's stated impact figures inaccurate, per multiple outlets cited by Wikipedia.
• 2025-09-12Date of last update on the current Packet Storm Security, LLC Terms of Service document (packetstorm.news / packetstormsecurity.com).