This business asks people to attribute, date, and source every claim. This page is where we hold ourselves to that. Each entry says what we published, where it ran, what is actually true and who says so, when we fixed it, and which places still carry it.
Newest first. An entry stays here after every place is fixed. Spotted something we should add? Reply to any Bayou Bytes issue.
2026-09-18 · W12 · misattributed quotation
We put words in CISA’s mouth about BOD 26-04
What we published
That CISA’s Binding Operational Directive 26-04 “encourages” organizations outside the federal government to adopt risk-based vulnerability management. We presented it as a direct quotation. It was not CISA’s wording.
Where it ran
Bayou Bytes #11 (emailed Sep 15, 2026, plus its web archive) · the week’s article on Hashnode · the GB013 Exposed Edge Kit fine print · two LinkedIn posts · two Mastodon posts.
What is actually true
BOD 26-04 does not address non-federal organizations anywhere in its text. It supersedes and revokes BOD 22-01, the older directive that carried language aimed at everyone else. What CISA does publish for everyone is on the KEV catalog page: Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.Source: cisa.gov/known-exploited-vulnerabilities, “How should organizations use the KEV catalog?” · checked 2026-09-21. The scope point we were making still stands: a Binding Operational Directive binds only the federal civilian agencies it names.
Fixed
2026-09-18: GB013 rebuilt and republished (new checksum) · Hashnode article corrected with a dated editor’s note · both LinkedIn posts edited, with a correction comment on each. 2026-09-26: Bayou Bytes #11 web archive corrected, with a dated note at the top · both Mastodon posts edited in place, with a dated correction line. The week’s video was re-recorded before it published, so the wrong line never aired.
Still carrying it
The Sep 15 email as delivered. A sent email can’t be recalled, so this page is its correction. Every other place listed above is corrected.
How it got through
A check in our build pipeline required the phrase to be present, so removing it counted as a failure. Our checks now test whether a claim is properly attributed, not whether a particular string is present.