I’m reading James Bamford’s new book on counterintelligence failures, Spyfail. It’s okay so far, but I would think any kind of technical review would have addressed this: I think it’s a significant error to equate an exploit to a virus/worm that uses it.