Editorial standards and corrections

ThreatRoundup exists to tell readers what happened, what it means for them, and what defenders should do about it. These are the rules we hold ourselves to.

Sourcing

Every story starts from primary or credible reporting: vendor advisories, government alerts (such as CISA), security researchers’ published work, court documents and established news outlets. We name and link the original source on every story. When a fact rests on a single source, we say so.

Claims made by ransomware gangs, hacktivists and other attackers are treated as claims until the victim or a credible independent source confirms them, and we label them that way. We never link to leaked data, stolen-data dumps or extortion sites, and we never publish victims’ personal information.

Exploits and indicators

We may say whether a public exploit or proof-of-concept exists, because that changes how urgently you should patch, but we never link to exploit code. Indicators of compromise (domains, IP addresses, URLs) are de-fanged so they can’t be clicked by accident.

Human review and AI assistance

A person decides which stories we cover and reviews and approves every article and Hunt Lead before it is published. We use AI tools to help with research, summarizing source material and drafting; every published piece is checked against its sources by a human editor, who is responsible for it.

Our CVE Watch vulnerability pages work differently: they are generated automatically from public data (the U.S. National Vulnerability Database, the official CVE record, CISA’s Known Exploited Vulnerabilities catalog and FIRST’s EPSS scores) so that every high and critical vulnerability has a page as soon as it is published. Each page names its data sources, and our written coverage is linked from the page when we have it.

Independence

We don’t accept payment for coverage, we don’t publish sponsored articles, and we don’t accept free products in exchange for reviews. Ads (served by Google AdSense) and affiliate links help pay for the site; neither advertisers nor affiliate partners see stories before publication or influence what we write. See our affiliate disclosure.

Corrections

If we get something wrong, we fix it quickly. Significant corrections (a wrong vendor, version, CVE ID, victim or attribution) are noted at the end of the story with the date of the correction. Small fixes such as typos are made without a note. Stories are also updated as a situation develops, for example when a patch ships or exploitation is confirmed.

To report an error, email tips@threatroundup.com with a link to the story and what needs correcting.

Responsible disclosure

If you’ve found a vulnerability, report it to the vendor (or through CISA’s coordinated disclosure process) first. We won’t publish details of an unpatched, undisclosed vulnerability that would put people at risk.