Terra Security finds broken security patches rising eightfold in open-source code
Analysis reveals that fixes for exploited vulnerabilities are frequently incomplete, providing attackers with clear roadmaps to bypass defenses.
Key points
- GitHub open-source fixes later reported as broken rose approximately eightfold by 2026.
- Patches for CISA Known Exploited Vulnerabilities break four times more often than other fixes.
- Blocklist-based fixes for SSRF and prototype pollution are particularly prone to bypass.
Terra Security researcher Oren Yomtov reports that security patches are increasingly serving as roadmaps for attackers due to a rising rate of incomplete fixes. His analysis of published CVE records and GitHub advisories reveals that a growing share of software updates are later found to be open to bypass, effectively guiding threat actors to remaining vulnerabilities.
Yomtov began tracking this trend after his team repeatedly encountered broken fixes in their own security work over the past year. Concerned that their findings represented sample bias, he expanded the scope to examine every published CVE record and GitHub-reviewed advisory. The data confirmed that while broken fixes have occurred at a steady rate for years, the share of open-source fixes on GitHub later reported as broken rose about eightfold by 2026.
Why patches fail
Fixes for vulnerabilities listed on the CISA Known Exploited Vulnerabilities catalog are reported as broken about four times as often as fixes for other bugs from the same vendors. Yomtov attributes this higher failure rate to the intense scrutiny these exploited bugs receive. Because known exploits draw significant attention from researchers and attackers alike, the patches receive more analysis, increasing the likelihood that missed elements or bypass methods will be identified.
Certain bug classes are inherently more difficult to patch completely. Vulnerabilities where the standard fix involves blocking specific inputs, such as server-side request forgery (SSRF) and prototype pollution, appear far more frequently among broken fixes than in the overall CVE population. Yomtov explains that when a blocklist fails to anticipate every possible variation of a malicious input, an attacker only needs to discover one variant that bypasses the check to exploit the underlying flaw.
Case studies in broken fixes
Roundcube, an open-source webmail platform, illustrates the challenges of patching SSRF flaws. In March 2026, developers released a fix for CVE-2026-35540 by blocking links to private addresses. However, the initial check missed other methods of writing the same address and domain names that resolved to those private IPs. Closing these gaps required three additional CVEs, released in May, July, and August of the same year.
Microsoft also faced issues with an incomplete patch for CVE-2026-21510, a Windows Shell vulnerability exploited in the wild by the APT28 group in February 2026. Akamai later discovered that the patch could be bypassed using a crafted Control Panel item, which caused Windows to contact an attacker’s server and leak the user’s NTLM hash. Microsoft addressed this bypass in April with CVE-2026-32202, which subsequently appeared on CISA’s exploited list without referencing the earlier CVE.
What should you do?
Yomtov argues that patches which only block reported inputs can create a false sense of security while the underlying bug remains in the code. Such incomplete fixes inadvertently reveal both the vulnerable code and the defender’s understanding of the bug to attackers. This dynamic suggests that organizations should not assume a patched vulnerability is fully mitigated, especially if the fix relies on simple input blocking rather than architectural changes.
What to do and how to stay safe: Terra Security
- Review patch notes for recent updates to determine if they rely on blocklists or input filtering, as these are more likely to be bypassed.
- Monitor security advisories for follow-up CVEs related to recently patched vulnerabilities, particularly those on the CISA Known Exploited Vulnerabilities catalog.
- Implement defense-in-depth strategies that do not rely solely on vendor patches for security, such as network segmentation and strict access controls.
- Test new patches in isolated environments to verify they fully mitigate the reported vulnerability before deploying them to production systems.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are security patches becoming less effective?
A growing share of patches are incomplete or open to bypass, particularly those that use blocklists to block specific inputs rather than fixing the underlying code logic.
Which types of vulnerabilities are most likely to have broken fixes?
Fixes for vulnerabilities on the CISA Known Exploited Vulnerabilities catalog and those involving blocklist-based defenses for SSRF and prototype pollution break most often.
Did the Microsoft Windows Shell patch fully fix the APT28 exploit?
No, the initial February 2026 patch for CVE-2026-21510 was bypassed in April 2026 via CVE-2026-32202, which allowed attackers to leak NTLM hashes through a crafted Control Panel item.
