# Correction: two errors in pre-publication drafts of Issue No. 44 concerning the Storm-0940 reporting

- **Artifact ID:** CHQ-CORR-2026-016
- **Status:** PENDING
- **Public record:** https://record.cybersecurityhq.com/corrections/chq-corr-2026-016
- **Machine-record SHA-256:** `71634a9f2f2e161eb6879d4105b4aa1e479da0f75505eb84e07bc9541be0c3ea`

## Complete structured record

```json
{
  "id": "CHQ-CORR-2026-016",
  "class": "CORRECTION",
  "subtype": "editorial",
  "status": "PENDING",
  "authority": "analyst declared 2026-10-27, ratification owed at the publisher",
  "effective": null,
  "published": "2026-10-27",
  "title": "Correction: two errors in pre-publication drafts of Issue No. 44 concerning the Storm-0940 reporting",
  "what_was_wrong": "First, a draft stated that the public record does not establish which agent framework was deployed in the ConnectWise intrusion. The responder states the opposite directly, naming the framework as used during that compromise to accelerate scanning and reconnaissance, password spraying and application abuse at downstream victims. The qualification was introduced in response to an external editorial review and was not checked against the primary source. Second, drafts carried a figure for tenant sign-ins within a stated number of minutes that does not appear in the source text; it appears only in an image.",
  "what_is_true": "Framework use in that operation is stated by the source. The figure that appears only in an image is withdrawn from all published text and replaced with figures verifiable in the source prose. The hold on the candidate instance now rests solely on the autonomy element, that the source does not separate unattended agent action from operator-directed activity, and on the attribution being an assessment rather than a confirmation.",
  "what_changed": "Both editions of Issue No. 44 were corrected before publication. The signal row carries a dated primary re-read note recording the verified figures, the withdrawn figure and the narrowed hold.",
  "what_did_not_change": "Neither error reached publication. No rating, Outlook, count or evidence class changed.",
  "control_analysis": "An editorial review that proposes a change to what a source established is not authority for that change. A rule that any published sentence asserting what a source does not establish must cite the primary-read date on which that absence was verified is proposed as a candidate, not an implemented control.",
  "found_by": "An external review, on checking a draft against the primary source."
}
```