Incomplete Security Fixes Rise as Attackers Use Patch Changes to Find Bypasses

Terra Security research found a sharp increase in open-source security patches subsequently reported as incomplete or bypassable, challenging the assumption that installing a fix closes a vulnerability. Reports citing researcher Oren Yomtov describe an approximately eightfold rise in 2026, with GitHub fixes requiring another patch within 90 days reaching 2.3%. Fixes for vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were reported broken about four times as often as fixes for other vulnerabilities affecting the same vendors. Blocklist-based fixes, prototype pollution and server-side request forgery were disproportionately represented among failed remediations. Although AI-assisted attacks feature in coverage of the findings, Terra did not establish that AI caused the increase.

Repeated bypasses of Roundcube’s server-side request forgery fixes and an incomplete Microsoft patch for an actively exploited Windows Shell vulnerability illustrate how narrowly scoped changes can expose vulnerable code without eliminating the underlying flaw. Some Linux kernel patches also introduced new vulnerabilities. Yomtov recommends that developers examine their own patch differences for bypass opportunities, review surrounding code and address root causes rather than blocking individual inputs. For defenders, the findings reinforce the need to validate remediation beyond successful installation and clean scanner results, scrutinize vendor fixes for exploited vulnerabilities, and test for bypasses and regressions.