According to research from AI penetration-testing startup Terra Security, reported by The Register, the era of "patch and move on" may be ending. After six years where only about 0.2 percent of GitHub security fixes required a follow-up advisory reporting a failed patch within 90 days, that figure jumped to 2.3 percent in 2026. Terra says the change tracks with the explosion of AI-assisted vulnerability discovery and patching this year.
One notable case involved Russian government cyberspies exploiting a Windows Shell bug, CVE-2026-21510, at least a month before Microsoft patched it in February. That patch was incomplete and left a second zero-click authentication coercion flaw, CVE-2026-32202, which was also found and abused before Microsoft fixed it in April.
Terra found that bypassed fixes are about four times as likely to appear on CISA's Known Exploited Vulnerabilities list. Prototype-pollution fixes were 11 times as common among broken-fix CVEs, while server-side request forgery fixes were 4.6 times as common. The reason, Terra says, is that these bugs are often fixed with blocklists of bad inputs, and attackers only need to find one encoding the blocklist misses. Linux kernel fixes are also risky: 3.2 percent of kernel CVEs were introduced by the fix for another CVE, rising to about 10 percent in busy subsystems like fs/smb and net/sched. Terra advises vendors to ask whether a patch fixes the root cause, covers the whole bug class, and breaks something else — and defenders should assume someone is reading every patch for a way around it.