When the Fix Fails: Security Patch Bypasses Are Rising Sharply in 2026

Installing updates is still essential, but it may not always be enough. AI penetration-testing startup Terra Security reviewed every published CVE record and GitHub-reviewed advisory, and found a sharp rise in security fixes that were later bypassed. Between 2019 and 2025, about 0.2 percent of GitHub security fixes needed a follow-up advisory reporting a failed patch within 90 days. In 2026, that figure jumped to 2.3 percent. The researchers describe the pattern this way: "A fix would ship, a bypass would be found, and another fix would go out."

A real example involves Russian government cyberspies, who exploited a Windows Shell security bypass bug (CVE-2026-21510) at least a month before Microsoft patched it in February. That patch was incomplete and left a second flaw (CVE-2026-32202), a zero-click authentication coercion vulnerability, which was also abused before Microsoft fixed it in April. Terra also found that vulnerabilities with bypassed fixes were about four times as likely to appear on CISA's Known Exploited Vulnerabilities list as other bugs affecting the same vendors.

Some bug types break more often than others. Prototype-pollution fixes were about 11 times as common among broken-fix CVEs as among all CVEs, and server-side request forgery fixes were 4.6 times as common. Terra says this is because such fixes often rely on blocklists of bad inputs: if the list misses one encoding, an attacker needs to find only that one. Fixes for Linux kernel vulnerabilities were also more likely to cause new bugs, according to kernel CNA records as of October 8. This summary is based on the opening of the article only.