Corrections policy
Last updated 29 October 2026.
Report an error
Email contact@pk-sharma.com with the address of the article and what you think is wrong. A link to the source that shows it helps most.
What happens next
- The claim is checked against the original source the article cites, and against any newer statement from the same source.
- If the article is wrong, it is fixed, and the change is dated on the article itself, usually in a section at the top.
- The change is listed, with its date and a line on what changed, in the corrections log.
- A briefing that its sources cannot support is withdrawn, and the withdrawal is listed in the same way.
Corrections and updates
A correction is marked where a headline, standfirst or finding was changed or withdrawn because it was wrong. An update adds new information, such as a vendor statement or a catalogue entry published after the article, and may date an earlier line that it overtakes. That earlier line is usually left in place, as the record of what the source said when the article was written.
Layout changes that leave the reporting as it was are not listed. The log starts on 1 October 2026; earlier changes are recorded on each article.
Latest entries
| Date | Type | Article and change |
|---|---|---|
| correction | AGENTS.md in Downloads briefing withdrawn: the drive by delivery and the MALFEX link are not in Forever Security's report Withdrawn and replaced with a notice. The drive by delivery, the MALFEX link, the stolen keys and the 25 October date were not in Forever Security's report, which is dated 22 October. | |
| update | PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts Added a note that CISA added both PHP flaws to its Known Exploited Vulnerabilities catalogue on 26 October with a federal due date of 29 October; the not listed statement describes the initial advisory release. | |
| update | 73.6 hours after the fix, three decoy servers logged the first of 35 shell starts Added a note that CISA added both PHP flaws to its Known Exploited Vulnerabilities catalogue on 26 October, so the statements here that neither was listed describe catalogue version 2026.10.23. | |
| update | LiteLLM supply chain attack poisons official PyPI and Docker builds with Python startup backdoor Added a note that LiteLLM's 23 October root cause post attributes the first token to an exposed master key committed on 27 May, not to the theft of tokens from three maintainers, and linked the newer briefing. | |
| correction | CISA lists shared hardcoded root CA key and missing authorization flaw in Moxa AIG-302 gateways Removed a fix description that neither CISA nor Moxa gives and corrected the authentication wording, severity wording and hardware figures. | |
| correction | Mave, founded by former Unit 8200 members, says it has raised $34M for agentic SecOps Corrected the round, which Dell did not co-lead, and removed performance figures and a quoted post that no source contains. | |
| correction | Black October briefing withdrawn: it presented executives' forecasts as events and invented a CISA directive Withdrawn: it presented forecasts as events and invented a CISA directive, statements and figures. | |
| correction | Ruby Onigmo briefing withdrawn: it misstated who assigned the CVEs, GitLab's fix dates and the defender advice Withdrawn: it misstated who assigned the CVEs, GitLab's fix dates and the defender advice. |