To get in touch about speaking at your event, email [email protected]
Media Packet · Press
853 items
853 items
Press
HackRead published an article on April 16, 2025, explaining slopsquatting, an attack that exploits inaccuracies in AI-generated code. Ellis outlines how the threat exploits developer trust in AI tools and underscores the importance of verification practices for generated code.
Press
Forbes published an article on the potential disruption of the Common Vulnerabilities and Exposures program and its impact on cybersecurity. Casey Ellis describes the CVE program as a common language for vulnerabilities that prevents chaos and enables coordinated defense across the industry.
Press
SC Magazine published an article on April 8, 2025, examining Xanthorox, a malicious AI tool designed to enable criminal activity without requiring jailbreaks. Casey Ellis discusses how Xanthorox demonstrates AI's dual-use potential, noting that while AI democratizes technology, it simultaneously reduces the technical barriers required to execute sophisticated cyberattacks.
Press
Xanthorox AI, a self-contained system for offensive cyber operations, has emerged on darknet forums
Press
An SC Magazine article covers an NSA advisory warning about fast-flux DNS evasion techniques as a national security threat. Casey Ellis describes the method as a shell game that conceals malicious servers and points to how cybercrime has become industrialized.
Press
Forbes published "Hack OpenAI And Win $100,000? What You Need To Know" on March 29, 2025, examining OpenAI's bug bounty initiative. Casey Ellis comments that the program represents a positive commitment to security and transparency that strengthens trust with users and security researchers.
Press
Forbes published an article on the surge in ransomware attacks and the security vulnerabilities enabling them. Casey Ellis attributes the increase to threat actors leveraging AI for sophisticated phishing campaigns and developing techniques to circumvent multi-factor authentication, while advocating for stronger defensive measures.
Press
Expert Insights published an interview with Dave Gerry and Casey Ellis from Bugcrowd at RSA 2024 on tackling AI bias. The two discuss how AI bias assessments can strengthen enterprise confidence in generative AI tools and large language models.
Press
CBS News Bay Area reported in May 2024 on the RSA Conference at San Francisco's Moscone Center, which drew over 40,000 attendees from 130 countries. The article covered the annual gathering of cybersecurity experts and entrepreneurs focused on industry trends and developments.
Press
A Dark Reading article details a critical authentication bypass vulnerability in Cisco small-to-medium business routers with publicly available proof-of-concept exploit code. Casey Ellis contributed security analysis and context on the vulnerability's impact and remediation guidance for affected organizations.
Press
Operation Zero will pay $20m for exploits like RCE, LPE and SBX, integral to a full-chain attack
Press
A New York Times article examines lessons from the LastPass breach and the role of password managers in cybersecurity. Casey Ellis discusses how password managers remain effective security tools despite recent high-profile compromises and outlines practices for mitigating breach risk.
Press
Following criticisms around ChatGPT’ security and privacy practices, OpenAI has launched a bug bounty program to help identify vulnerabilities across its systems and services
Press
Dark Reading published coverage of a data breach at Five Guys that exposed sensitive human resources data. Casey Ellis commented on the incident, discussing the security implications and response measures for restaurant chain data breaches.
Press
It shows the threat actor trying to convince Royal Mail to pay the ransom using various techniques
Press
Clearance Jobs published an article examining cybersecurity job demand in the U.S. amid tech sector layoffs. Casey Ellis discusses the continued need for skilled cybersecurity professionals despite industry workforce reductions and broader economic pressures on hiring.
Press
SC Magazine published an article examining how artificial intelligence and dynamic application security testing can reduce security vulnerabilities. Casey Ellis discusses the intersection of AI and DAST technologies and their role in strengthening application security defenses against emerging threats.
Press
A Channel Futures report documents Cisco's decision to leave critical vulnerabilities unpatched in several end-of-life small business routers, recommending customer migration to newer hardware instead. Casey Ellis commented on the security implications of the vendor's approach and the risks posed to organizations still operating the affected devices.
Press
Teiss published a press item covering Cisco's warning about two critical vulnerabilities in end-of-life routers that will not receive patches. Casey Ellis is quoted commenting on the security implications and risk management considerations for organizations still operating the affected equipment.
Press
Cisco did not release updates to address the vulnerabilities and no workarounds address them
Press
Bugcrowd received designation as a CVE Numbering Authority from the CVE Program, according to an announcement published by It News Online. Casey Ellis, Bugcrowd's founder, stated the company now directly assigns CVE identifiers to vulnerability reports submitted through its platform.
Press
Yahoo Finance reported in November 2022 that Bugcrowd received authorization to serve as a CVE Numbering Authority, enabling the company to assign CVE identifiers to newly discovered vulnerabilities. Casey Ellis, Bugcrowd's founder and chief strategy officer, stated that the designation reflects the company's commitment to improving vulnerability disclosure and strengthening the security community's ability to track and address threats.
Press
Forbes published a feature in which 15 technology experts shared recent consumer-facing tech developments they find innovative. Casey Ellis contributed his perspective on emerging technologies that capture expert interest in the consumer tech space.
Press
Security Magazine published an analysis of a shareholder lawsuit against SolarWinds following its major data breach. Casey Ellis contributes key lessons for CISOs on disclosure, liability, and supply chain security based on the litigation's implications.
Press
SC Magazine published an analysis clarifying distinctions between the Text4Shell and Log4Shell vulnerabilities. Casey Ellis explains that while Text4Shell is serious, it lacks the widespread impact and severity profile of Log4Shell, helping organizations prioritize remediation efforts appropriately.
Press
The Record by Recorded Future published an article on October 19, 2022 examining expert assessments of the Text4Shell vulnerability in Apache Commons. Casey Ellis commented on the limited real-world exploitability and practical impact of the bug despite initial security concerns.
Press
Duo Security published an article on a critical remote code execution vulnerability in Apache Commons Text, known as Text4Shell, and the subsequent patch released to address it. Casey Ellis contributed analysis and commentary on the vulnerability's severity and implications for affected systems.
Press
CPO Magazine reported on the conviction of former Uber Chief Security Officer Joe Sullivan for obstructing justice and concealing data breaches from federal authorities. The case underscores accountability measures for security leaders who fail to disclose breach incidents to regulators as required by law.
Press
The Register published an article in October 2022 examining why users select security and privacy tools based on marketing appeal rather than technical merit. Casey Ellis discusses how organizations and individuals should evaluate cybersecurity solutions with greater rigor and focus on substantive capabilities instead of vendor claims.
Press
Tech News World reported on the guilty verdict against former Uber security chief Joe Sullivan, who was convicted of obstruction of justice and other charges related to covering up a 2016 data breach. The case centered on Sullivan's decision to pay hackers ransom rather than disclose the breach to regulators and affected users.