Terra says GitHub patch-failure share rose from 0.2% to 2.3%
Original title: Security patches need patches now that attackers have AI
Fixes later bypassed were about four times as likely to appear on CISA's KEV list as other bugs from the same vendors.
Terra Security reviewed CVE records and GitHub advisories and says the share of security fixes needing a follow-up failed-patch advisory within 90 days rose from about 0.2 percent in 2019-2025 to 2.3 percent in 2026. Prototype-pollution and SSRF fixes, often based on blocklists, failed most often. Linux kernel CNA records show 3.2 percent of kernel CVEs were introduced by another CVE's fix. Terra links the rise to this year's surge in AI vulnerability discovery and patching.
Unconfirmed: The 2026 jump and its link to AI-assisted patching are Terra's findings, not independently confirmed.
- Prototype-pollution bugs were about 11 times as common among broken-fix CVEs.
- SSRF vulnerabilities were 4.6 times as common among those broken fixes.
- About 10 percent of CVEs in fs/smb and net/sched came from prior fixes.
- Microsoft's February fix for CVE-2026-21510 left CVE-2026-32202, abused before an April fix.
Impact: Incomplete Windows fixes left a zero-click authentication-coercion flaw
| Product | Affected |
|---|---|
| Microsoft Windows | — |
- 1.Treat a fix for an exploited bug as likely to be mined for a bypass.
- 2.Check whether a patch fixes the root cause and the whole bug class.
- 3.Verify a patch does not introduce a separate flaw before deploying it.
- Vendors
- Microsoft
- Products
- Windows
- Organizations
- Terra SecurityCISA
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21510 | Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510) | 8.8 | 25% | KEV | KEV |
| CVE-2026-32202 | Spoofing Flaw in Windows Shell (CVE-2026-32202) Actively Exploited | 4.3 | 5% | KEV | KEV |
From the original article
2 min read at theregister.comTerra finds sharp rise in GitHub security fixes reported broken within 90 days
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.