Security Patches Need Patches Now That Attackers Have AI
The Register, Monday, October 19th, 2026
Terra Security finds GitHub security fixes later reported broken within 90 days jumped from 0.2% to 2.3% in 2026.
Terra Security reviewed every published CVE record and GitHub-reviewed advisory for fixes later found incomplete or bypassable.
The share of GitHub security fixes needing a follow-up advisory within 90 days held at about 0.2% from 2019 to 2025, then jumped to 2.3% in 2026 as AI-driven discovery grew.
Fixes for bugs on CISA's KEV list were about four times as likely to be bypassed, and blocklist-style fixes for SSRF and prototype pollution failed most often.
The Register cites Microsoft's incomplete Windows Shell patch as an example; the takeaway is that patching alone is not enough and fixes need follow-up validation.