Terra reports sharp rise in GitHub security fixes broken within 90 days in 2026

AI penetration-testing startup Terra Security reports a significant increase in security patches that fail to fully resolve vulnerabilities. Researchers observed a sharp rise in reported patch failures during 2026, breaking a trend of relatively low bypass rates seen over the previous six years.

Terra analysts examined every published Common Vulnerabilities and Exposures record and GitHub-reviewed advisory to identify instances where initial fixes were insufficient. The data reveals a recurring cycle where a vendor ships a fix, attackers find a bypass, and the vendor releases another update.

The Scale of Patch Failures

Between 2019 and 2025, only about 0.2 percent of GitHub security fixes required a follow-up advisory reporting a failed patch within 90 days. According to Terra, that figure jumped to 2.3 percent in 2026. This increase coincides with an explosion in AI-driven vulnerability discovery and automated patching efforts.

The researchers noted that vulnerabilities with broken fixes are significantly more likely to be actively exploited. These flaws are about four times as likely to appear on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities list compared to other bugs affecting the same vendors.

Vulnerable Vulnerability Types

Not all vulnerabilities are equally prone to failed patches. Terra found that server-side request forgery fixes and prototype-pollution patches break the most often. Compared to their overall share of all CVEs, prototype-pollution vulnerabilities were about 11 times as common among those with broken fixes.

Server-side request forgery vulnerabilities were 4.6 times as common in the broken-fix category relative to their total CVE share. These statistics suggest that certain classes of flaws remain difficult to remediate comprehensively in a single update, even with increased scrutiny.

Microsoft Windows Shell Exploits

A specific example from Microsoft illustrates the rapid exploitation cycle. Russian government cyberspies exploited a zero-day Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched it in February. The initial patch was incomplete and left a second flaw.

That second flaw, a zero-click authentication coercion vulnerability identified as CVE-2026-32202, was also found and abused by attackers. Microsoft fixed this secondary vulnerability in April, but the window of exposure remained open for weeks after the first patch was distributed to users.

What should you do?

Security teams should monitor CISA’s Known Exploited Vulnerabilities list closely for updates on previously patched flaws. Organizations relying on GitHub-hosted software should review follow-up advisories for any critical fixes deployed in the last 90 days.

What to do and how to stay safe: Terra Security

• Review internal patch management logs to verify that secondary fixes for CVE-2026-21510 and CVE-2026-32202 are applied on Windows systems.
• Audit deployments for prototype-pollution and server-side request forgery vulnerabilities, as these have high rates of broken initial patches.
• Monitor vendor advisory feeds for follow-up updates released within 90 days of initial security fixes, rather than assuming the first patch is sufficient.
• Configure vulnerability scanners to alert on newly added entries to the CISA Known Exploited Vulnerabilities catalog, which often signals active abuse of patched flaws.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many GitHub security fixes were broken within 90 days in 2026?

According to Terra Security, 2.3 percent of GitHub security fixes required a follow-up advisory reporting a failed patch within 90 days in 2026.

Which types of vulnerabilities have the highest rate of broken patches?

Prototype-pollution and server-side request forgery fixes break the most, with prototype-pollution being 11 times more common among broken-fix CVEs than its share of all CVEs.

Did Microsoft fix the Windows Shell bypass bug completely in February 2026?

No, the February patch for CVE-2026-21510 was incomplete and left a second zero-click authentication coercion vulnerability, CVE-2026-32202, which was fixed in April.