Terra finds incomplete security patches surged in 2026
October 20: Help Net Security adds Oren Yomtov, an eightfold GitHub rise, Roundcube’s three follow-on CVEs, and APT28 plus an Akamai bypass that leaked an NTLM hash.
Terra Security says incomplete or bypassed security fixes became far more common in 2026, especially around exploited bugs.
Terra Security’s review of CVE records and GitHub advisories finds fixes later reported incomplete or bypassable rose sharply in 2026 after years of rare cases. The Register says the share needing a follow-up failed-patch advisory within 90 days rose from about 0.2 percent in 2019-2025 to 2.3 percent; Help Net Security calls the GitHub rise about eightfold. Prototype-pollution and blocklist-style SSRF fixes failed most often. The outlets disagree on a fourfold CISA KEV link: The Register says later-bypassed fixes were about four times as likely to appear on the list, while Help Net Security says KEV fixes were later reported broken about four times as often. Terra ties the rise to this year’s AI vulnerability-discovery and patching surge.
- The Register: broken-fix share rose from about 0.2% to 2.3% in 2026.
- Help Net Security describes that GitHub share as rising about eightfold.
- Prototype pollution was about 11 times as common among broken-fix CVEs.
- SSRF bugs were 4.6 times as common among those broken fixes.
- Linux kernel records: 3.2% of kernel CVEs came from another fix.
- Roundcube CVE-2026-35540 needed three more CVEs from March through August.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026The Register reports Terra’s rise in broken fixes · The Register
- Oct 20, 2026Help Net adds KEV, Roundcube and Windows cases · Help Net Security
What each outlet adds
beyond the shared facts- The RegisterGives 0.2-to-2.3 percent figures, kernel rates, and AI-patching link.
- Help Net SecurityNames Yomtov, Roundcube follow-ons, APT28, and the NTLM leak.
- Vendors
- Microsoft
- Products
- RoundcubeWindows ShellWindows
- Threat actors
- APT28
- Organizations
- Terra SecurityCISAAkamai
- Countries
- Russia
Coverage
oldest first · one row per article · UTC- · 6d ago
The Register · SecurityFirst report
Terra says GitHub patch-failure share rose from 0.2% to 2.3%
Fixes later bypassed were about four times as likely to appear on CISA's KEV list as other bugs from the same vendors.
- · 5d ago
Help Net Security
Incomplete security patches rose about eightfold in 2026
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21510 | Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510) | 8.8 | 25% | KEV | KEV |
| CVE-2026-32202 | Spoofing Flaw in Windows Shell (CVE-2026-32202) Actively Exploited | 4.3 | 5% | KEV | KEV |
| CVE-2026-35540 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14 | 6.5 | <1% |