Corrections & retractions
Every threat record is checked against its canonical source before it is published, and the feed is re-reviewed as sources update. When we find an error, we correct the record in place. When an item should not have been published at all, we retract it — remove it and list it here, with what was wrong and what the correct state is. Retractions are never made silently.
Retracted 22 October 2026
#StopRansomware: SafePay Ransomware
Formerly at /threats/stopransomware-safepay-ransomware-93b7ba
What was wrong: the page carried a “CISA KEV” badge. The item is a CISA ransomware advisory (AA26-293A) — it is not an entry in the CISA Known Exploited Vulnerabilities catalog (it carries no CVE), and it is not relevant to PHP.
Correct state: a CISA advisory, not a KEV entry. The record has been removed.
CISA Malcolm
Formerly at /threats/cisa-malcolm-c89311
What was wrong: the page carried a “CISA KEV” badge. The item is a CISA ICS advisory for Malcolm, a network-analysis tool; none of its CVEs (CVE-2026-107333 through CVE-2026-107362) appear in the CISA KEV catalog, and it is not relevant to PHP.
Correct state: a CISA ICS advisory, not a KEV entry. The record has been removed.
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Formerly at /threats/chinese-government-linked-cyber-threat-actors-combine-automa-56160a
What was wrong: the page carried a “CISA KEV” badge. The item is a general CISA threat-actor advisory (AA26-281A) — not a KEV catalog entry, and not relevant to PHP.
Correct state: a CISA advisory, not a KEV entry. The record has been removed.
Also corrected 22 October 2026
The same review checked all 88 live records and corrected 38 of them in place. Three fixes matter most: KEV status is now decided by an exact CVE match against the KEV catalog (an advisory that merely references catalog CVEs is not KEV); severity scores are taken from the National Vulnerability Database, and items without a score are shown as “Unrated” instead of a default severity; and PHP branch verdicts are shown only for PHP itself — library advisories list their own fixed versions. The three items above were the only ones removed.