Terra Security found a sharp rise in GitHub security fixes failing within 90 days. The share jumped from 0.2% to 2.3% in 2026. Broken fixes were four times likelier to appear on CISA’s exploited list. Prototype-pollution and server-side request forgery patches broke most often. Blocklist-based fixes often miss encoded bad inputs. Linux kernel fixes also frequently introduce new bugs. Vendors should ask if a patch fixes the root cause. They should also check if it covers the whole bug class. They should verify it does not break something else. Sysadmins should assume attackers study patches for bypasses.
What changed
Patch bypasses were rare and stable at 0.2% for six years.
What it unlocks
Attackers can now exploit known patch bypass patterns to reopen vulnerabilities.
- 0.2% of GitHub security fixes needed follow-up within 90 days (2019–2025)
- 2.3% of GitHub security fixes needed follow-up within 90 days (2026)
- 4x more likely to appear on CISA KEV list
- 11x over-representation of prototype-pollution in broken-fix CVEs
Sources