Patching only gets you so far. AI pen-testing startup Terra Security looked at every published CVE record and GitHub-reviewed advisory and found a sharp rise in fixes that got bypassed.
The numbers
- From 2019 to 2025, about 0.2% of GitHub security fixes needed a follow-up “failed patch” advisory within 90 days. In 2026 it’s 2.3%.
- Bugs with bypassed fixes were about 4x as likely to land on CISA’s Known Exploited Vulnerabilities list.
- Prototype pollution and SSRF fixes break the most, because blocklists rarely cover every encoding. “The attacker only needs to find one.”
- 3.2% of Linux kernel CVEs were introduced by the fix for another CVE.
Example: a Windows Shell bypass, CVE-2026-21510, was patched in February, but the fix left CVE-2026-32202, which was also exploited before April’s fix.
My take
AI finds bugs faster on both sides now. Patch, then keep watching the advisory for follow-ups. Don’t treat “patched” as “done.”
