Eight Corrections: What We Got Wrong, What Was Already Published When We Wrote It, and What We Do Differently Now
We audited 120 of our own posts, about 360 claims, against primary sources. Most held up. Eight did not, and in each of the eight the information we needed was already published when we wrote the post. This post lists them, gives the right answer, and says what we changed. Where a fact only arrived after we published, that is an update, and we handle it in a new post, not here.
The test we used: a mistake is a claim where the data existed and was reachable at the moment we published. An update is something that arrived later. Only mistakes belong on this list.
1. Arista VeloCloud: it did publish indicators, and the deadlines were different
Our July 29 post said Arista had published no indicators, no IP addresses, domains or hashes, and that nobody could hand you a blocklist. It also said federal agencies had until July 30 to remediate both of the day's CISA additions.
Arista's own advisory, 24364-0144, was published July 27 and lists three IP addresses it says were observed conducting the attacks: 8.19.75.217, 206.72.242.124 and 206.72.242.162. It also says there is no single definitive indicator of compromise, so log review still matters. And the July 30 date applied only to the Arista bug (CVE-2026-16812). The Fortinet FortiOS bug in the same pair (CVE-2025-68686) was due August 10.
If you read our post and skipped blocking those three addresses, that one is on us.
2. Salt Typhoon: the advisory does list addresses and hashes
Our July 18 post said CISA's Salt Typhoon advisory, AA25-239A, listed 88 indicators and that you could block exactly none of them, because not one was an address, a domain or a hash.
The advisory, first published August 27, 2025, lists about 86 IP addresses (two of them IPv6), six file hashes across four SFTP client binaries, and offers a downloadable STIX file. It lists no domains. CISA's own caution is real: the addresses span August 2021 to June 2025, some may no longer be in use, and CISA says to vet before blocking. So the honest sentence is that you can block roughly 86 addresses and should vet them first, not that you can block none.
3. Avalon: we blended two malware families
Our July 4 post said the Avalon framework hands its control plane to Groq, with an attacker typing English and a public language model writing shell commands, and tied a VirusTotal upload to it.
Blackpoint's report, published July 2, contains none of that. It ties Avalon's command channel to helloxcherry[.]com (the tasking endpoint is /api/v2/tasking) and lists cherryvblueberry[.]com as a staging domain. The Groq and Telegram behavior, and the March 11 VirusTotal upload, belong to a separate sample covered in the same news roundup. The C2 domain in our post was right. The Groq story was not about Avalon.
4. FortiSandbox: three days, not four
Our July 17 headline said federal agencies got four days. CISA added the FortiSandbox flaws on Thursday, July 16, with a due date of Sunday, July 19. That is three days.
5. NetScaler: Sunday, not Saturday
Our September 29 post said Citrix shipped patches on Saturday and CISA listed both flaws the same day. The advisory and the KEV listing were both Sunday, September 27. Saturday was when some administrators had been told privately to shut appliances down.
6. ENCFORGE: an ingest, not a lead
Our July 21 post said we had been blocking the campaign's infrastructure "since Friday," three days before the writeup that named it. Our record for 45.131.66.106 was first seen on Saturday, July 18, and it came from Sysdig's earlier JADEPUFFER report, so it was an ingest of their research and not our own detection. Sysdig's ENCFORGE writeup, dated July 20, is two days later, and it lists that address as the attack's source IP. The address was blocked, and that part stands. The framing as being ahead of the writeup does not.
7. GPT-6 Cyber and Brotli: CISA had already listed it
Our November 8 post said we could not confirm whether CISA lists the Brotli flaw CVE-2026-111497. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, with a federal due date of November 10. That was a twelve-day-old fact in a public catalog, and our own copy of the KEV data has the record.
8. Alpine Linux: the CVE already existed
Our November 6 post carried the title "There Is No CVE Yet." The CVE, CVE-2026-123158, was published November 5 at 15:46 UTC in the MITRE record, with NVD following at 16:17, about eleven hours before our post. We published a follow-up on November 7 with the CVE and the first exploitation report, but the earlier title was a claim we could have checked at the source.
One correction to our own feed
Our hashes.csv feed dropped every row older than 90 days, including hashes from the hand-curated campaign research we publish, while its headers said the feed was complete. A rotating command-and-control address can fairly age out. A file hash does not. The IP and domain feeds had been fixed for this in September, and the hash feed had not. We fixed it on November 8. The feed now serves 168 curated campaign hashes that had been in our index but missing from the file, including the ENCFORGE hashes.
What changed
The pattern across the eight is the same: a claim that something does not exist, or has not happened, written without opening the primary source. Our rule now is that any statement of the form "no indicators," "no CVE yet" or "not in the catalog" gets checked against the source document and against our own index before it publishes, and if we cannot check, the sentence names where we looked and does not claim a general absence. Dates and deadlines are checked against the CISA catalog file, not written from memory.
We also found claims we could not yet prove either way, and we are checking those against primary sources before we say anything about them. If they turn out to be mistakes they will show up in the next one of these.
If you spot something we got wrong, tell us. We would rather correct it in public than have you find it later.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.