Reports of failed GitHub security fixes rise sharply in 2026
Terra Security says software security fixes are increasingly being bypassed, with a sharp rise in follow-up reports of broken GitHub fixes during 2026. The trend matters because attackers can study a patch to find ways around it, leaving systems exposed even after administrators believe a vulnerability has been fixed.
Terra found that the share of GitHub security fixes followed by an advisory reporting failure within 90 days rose from about 0.2 per cent in each year from 2019 to 2025 to 2.3 per cent in 2026. Bugs with bypassed fixes were about four times as likely as other bugs from the same vendors to appear on CISA’s Known Exploited Vulnerabilities list. Prototype-pollution and server-side request forgery fixes were especially prone to failure, while 3.2 per cent of Linux kernel CVEs were introduced by fixes for other CVEs, rising to about 10 per cent in some busy subsystems.
- Broken security fixes rose to 2.3 per cent in 2026.
- Bypassed fixes were more likely to be actively exploited.
- Vendors and patch managers should check fixes for ways around them.
Read the full article at the source →
Originally published by The Register as “Security patches need patches now that attackers have AI”.