Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
MITRE set to lose funding today, CISA intervenes
Security Magazine's April 16, 2025 article reports that CISA has extended MITRE's funding, and security leaders share their views on the move. Casey Ellis, founder of Bugcrowd, warns that CVE underpins much of vulnerability management, incident response, and critical infrastructure protection, so a sudden interruption could quickly become a national security problem.
Bill extends cyber threat info-sharing between public, private sector
This Cybersecurity Dive article, published April 16, 2025, reports on a bill extending the Cybersecurity Information Sharing Act of 2015, which provides a framework for public and private threat information sharing. Casey Ellis, founder of Bugcrowd, says cybersecurity is a team sport and that the act underpins public-private sharing that powers U.S.-based ISACs.
What is Slopsquatting: A New Threat to AI-Generated Code Security
HackRead published an article on April 16, 2025, explaining slopsquatting, an attack that exploits inaccuracies in AI-generated code. Ellis outlines how the threat exploits developer trust in AI tools and underscores the importance of verification practices for generated code.
Nonprofit That Tracks Software Flaws in Jeopardy Following Funding Cuts
This PCMag UK article reports that MITRE's funding for the CVE software vulnerability tracking program was set to run out after the Trump administration canceled a $29 million contract. Casey Ellis, founder of Bugcrowd, says he hopes the situation resolves quickly, since CVE underpins much of vulnerability management and critical infrastructure protection.
Mitre Says Funding Set To Expire For Its Work On Crucial Vulnerability Program
This CRN article from April 15, 2025 reports federal funding for Mitre's role in the CVE program was set to expire. In an email to CRN, Bugcrowd founder Casey Ellis said the CVE program underpins much of vulnerability management and critical infrastructure protection, warning that a sudden interruption could become a national security problem.
Cybersecurity World On Edge As CVE Program Prepares To Go Dark
Forbes published an article on the potential disruption of the Common Vulnerabilities and Exposures program and its impact on cybersecurity. Casey Ellis describes the CVE program as a common language for vulnerabilities that prevents chaos and enables coordinated defense across the industry.
New Xanthorox AI Threat Puts MSSPs, MPS, and Security Teams on Notice
This MSSP Alert article, published April 14, 2025, covers the emergence of Xanthorox, a modular AI threat platform, and how MSSPs should respond. Casey Ellis, founder of Bugcrowd, tells the publication that MSSPs and MSPs must embrace AI as both a tool and a threat, calling Xanthorox a force multiplier for attackers.
Hackers using AI-produced audio to impersonate tax preparers, IRS
This April 2025 article from The Record reports that hackers are using AI-generated audio to impersonate tax preparers and the IRS. Bugcrowd founder Casey Ellis says generative AI and deepfakes are game-changers for scammers that let attackers scale operations and boost believability, and he advises people to look for inconsistencies.
DtSR Episode 649 - Casey Ellis Other People's Software Bugs
Down the Security Rabbithole published episode 649 of its video podcast series on April 10, 2025, featuring Casey Ellis discussing bug bounties and the vulnerability disclosure landscape. Ellis addresses the evolution of coordinated vulnerability management and shares perspective on industry direction with hosts Rafal, James, and Jim.
Google hopes its experimental AI model can unearth new security use cases
This April 2025 CyberScoop article covers Google's experimental Sec Gemini cybersecurity assistant and its call for researchers to test it. Casey Ellis, chief technology officer at BugCrowd, says Sec Gemini's benchmarks suggest it can handle complex workflows, and he endorses Google's early crowdsourced testing while warning firms not to replace staff with it.
Malicious AI tool Xanthorox claims advanced capabilities for criminals, no jailbreaks required
SC Magazine published an article on April 8, 2025, examining Xanthorox, a malicious AI tool designed to enable criminal activity without requiring jailbreaks. Casey Ellis discusses how Xanthorox demonstrates AI's dual-use potential, noting that while AI democratizes technology, it simultaneously reduces the technical barriers required to execute sophisticated cyberattacks.
Xanthorox AI emerges as a new malicious threat in cybercrime communities - SiliconANGLE
A SiliconANGLE article from April 7, 2025 reports on Xanthorox AI, a malicious tool emerging in cybercrime communities. In it, Bugcrowd founder Casey Ellis calls the tool a fascinating development and notes that the cybercriminal ecosystem operates much like any service and platform industry rather than as one amorphous mass of badness.
Darknet’s Xanthorox AI Offers Customizable Tools for Hackers
Infosecurity Magazine reports on Xanthorox AI, a self-contained system for offensive cyber operations that has emerged on darknet forums. Casey Ellis, founder of Bugcrowd, calls it a fascinating development and notes that the cybercriminal ecosystem operates much like any service and platform industry, while highlighting the strategic depth and R&D behind the tool's design.
Cyber PIVOTT Act Would Offer Cybersecurity Degrees for Public-Sector Work
GovTech published this April 2025 article on the Cyber PIVOTT Act, a congressional bill proposing full scholarships for two-year cybersecurity degrees tied to two years of public-sector work. Casey Ellis, founder of Bugcrowd, says government leaders increasingly see cybersecurity training as an urgent priority, and that the bill is still finding its place.
Longtime ‘Fast Flux’ Evasion Technique Now a National Security Threat
This April 4, 2025 Security Boulevard article covers a CISA, FBI, and NSA advisory on fast flux, a decades-old technique threat actors use to evade detection. Bugcrowd founder Casey Ellis says the technique's resurgence reflects a shift in attacker behavior, calling the advisory a national security issue that demands immediate attention.
Ransomware Payments Ban: What it Means for Businesses
SC Media UK's insight article "Ransomware Payments Ban: What it Means for Businesses," published April 2025, examines banning ransom payments. Bugcrowd founder Casey Ellis calls stopping ransom payments ambitious, saying a ban without coordinated geopolitical cooperation would be largely ineffective and could leave targeted organizations in a tough spot.
US, Australia, Canada warn of ‘fast flux’ scheme used by ransomware gangs
The Record article reports on a joint US, Australia, and Canada advisory warning that ransomware gangs and Russian state hackers use the old fast flux technique to hide infrastructure. Casey Ellis, founder of Bugcrowd, notes the technique dates to 2007 and says its refinement and wider use by threat actors has prompted heightened alert.
Founder of BugCrowd - Casey Ellis | Coffee & Pizza Podcast #023
Coffee & Pizza Podcast episode 023 features Casey Ellis, founder of Bugcrowd, discussing his background and career path. Ellis shares his early experiences as a hacker in Australia and the journey that led him to establish Bugcrowd as a crowdsourced security platform.
NSA: Fast-flux DNS evasion technique now a national security threat
An SC Magazine article covers an NSA advisory warning about fast-flux DNS evasion techniques as a national security threat. Casey Ellis describes the method as a shell game that conceals malicious servers and points to how cybercrime has become industrialized.
Hack OpenAI And Win $100,000? What You Need To Know
Forbes published "Hack OpenAI And Win $100,000? What You Need To Know" on March 29, 2025, examining OpenAI's bug bounty initiative. Casey Ellis comments that the program represents a positive commitment to security and transparency that strengthens trust with users and security researchers.
JFK and the Houthis: Haste Makes Waste of Security
This Security Boulevard article from March 28, 2025, reports that the final JFK files exposed Social Security numbers of people tied to the investigation. Bugcrowd co-founder Casey Ellis says Social Security numbers follow a predictable pattern that technology can detect, but data volume, false positives, and handwritten content make such documents harder.
23andMe declares bankruptcy, security leaders discuss data concerns
An article from Security Magazine, published March 26, 2025, covers 23andMe's bankruptcy declaration and the data risks it raises for customers, with security leaders weighing in. Casey Ellis, founder of Bugcrowd, says the bankruptcy is a timely reminder that even well-protected genetic data can be sold in ways users cannot control.
Massive Surge In Ransomware Attacks, AI And 2FA Bypass To Blame
Forbes published an article on the surge in ransomware attacks and the security vulnerabilities enabling them. Casey Ellis attributes the increase to threat actors leveraging AI for sophisticated phishing campaigns and developing techniques to circumvent multi-factor authentication, while advocating for stronger defensive measures.
New Tenable Report Finds DeepSeek Can Be Jailbroken to Create Malware - CPO Magazine
This CPO Magazine article, dated March 24, 2025, reports on a Tenable study showing DeepSeek can be jailbroken to produce basic malware. Casey Ellis, founder of Bugcrowd, is quoted saying bad actors will keep probing AI tools until guardrails mature, and that security teams must stay ahead.
EPSS is not foolproof: Shift your AppSec beyond vulnerabilities
This Security Boulevard article from March 18, 2025, argues that EPSS scores are not enough and organizations must look beyond vulnerability remediation to manage software cyber-risk. Casey Ellis of Bugcrowd says machine learning ranks known threats well but struggles to predict unknown exploits, and advises prioritizing CISA KEV entries and asset criticality.
DeepSeek can develop malware, cyber experts are sharing the risks
This Security Magazine article from March 17, 2025, examines Tenable research showing DeepSeek can generate malware, and what the findings mean for organizations. Casey Ellis, founder of Bugcrowd, says the results highlight the dual-use nature of generative AI, noting that such systems can produce malware even when manual intervention is needed.
Microsoft Warns About Chinese Hackers Silk Typhoon Using IT Supply Chain Attacks for Cyberespionage - CPO Magazine
CPO Magazine published this press article on March 14, 2025, reporting Microsoft Threat Intelligence's warning that Chinese state-linked Silk Typhoon targets IT supply chains to reach downstream customers. Casey Ellis, Founder of Bugcrowd, says the group's data aligns with Chinese geopolitical interests, focusing on government policies, intellectual property, and strategic intelligence across multiple sectors.
Cyber leaders weigh in on proposed vulnerability disclosure policy
Security Magazine published this March 11, 2025 article, which gathers cybersecurity leaders' views on the proposed Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025. Casey Ellis, founder of Bugcrowd, says the bill turns vulnerability disclosure policies and hacker feedback from optional extras into a mandatory procurement requirement, building on Hack the Pentagon.
Passwords Are Broken - Can 3,600 Smiley Faces Fix Them?
This Forbes article, published March 11, 2025, and written by Davey Winder, asks whether emojis could offer a secure alternative to broken passwords. Casey Ellis appears in this press coverage as one of the people consulted on the question of whether emoji passwords can genuinely hold up under scrutiny.
New Vulnerability Disclosure Program for Federal Contractors Passes House - CPO Magazine
This CPO Magazine article from March 10, 2025, reports that the House passed a bill requiring federal contractors to adopt vulnerability disclosure programs. Casey Ellis, founder of Bugcrowd, is quoted saying that making vulnerability disclosure programs a procurement requirement under HR 872 speeds acceptance of hacker feedback across government and its contractors.