{"id":808212,"date":"2026-10-20T03:40:13","date_gmt":"2026-10-20T03:40:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/808212\/"},"modified":"2026-10-20T03:40:13","modified_gmt":"2026-10-20T03:40:13","slug":"security-patches-need-patches-now-that-attackers-have-ai","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/808212\/","title":{"rendered":"Security patches need patches now that attackers have AI"},"content":{"rendered":"

<\/p>\n

\n patches\n <\/p>\n

<\/a><\/p>\n

\n Terra finds sharp rise in GitHub security fixes reported broken within 90 days\n <\/p>\n

Updating your software only gets you so far. A scary scenario – security fixes themselves being bypassed – is becoming more common, according to AI penetration-testing startup Terra Security, which found a sharp rise in reported patch failures in 2026 after years of relatively low numbers. <\/p>\n

And no, it\u2019s not a coincidence that AI vulnerability discovery<\/a> and patching<\/a> also exploded this year.<\/p>\n

For example, Russian government cyberspies exploited a zero-day<\/a> Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched the flaw in February. Redmond\u2019s patch, however, was incomplete, and left a second flaw – a zero-click authentication coercion vulnerability (CVE-2026-32202) – that was also found and abused<\/a> before Microsoft fixed it in April.<\/p>\n

Terra researchers reviewed every published CVE record and GitHub-reviewed advisory looking for broken fixes, and found a distinct pattern<\/a>. After six years of relatively few patch bypasses, this changed in 2026: \u201cA fix would ship, a bypass would be found, and another fix would go out.\u201d<\/p>\n

The share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained at about 0.2 percent between 2019 and 2025. This year, this figure had jumped to 2.3 percent, according to the researchers. <\/p>\n

Meanwhile, vulnerabilities whose fixes were later bypassed were about four times as likely to appear on the US Cybersecurity and Infrastructure Security Agency’s (CISA’s) Known Exploited Vulnerabilities list as other bugs affecting the same vendors, according to Terra.<\/p>\n

Of these, server-side request forgery fixes and prototype-pollution patches break the most. Compared with their share of all CVEs, prototype-pollution vulnerabilities were about 11 times as common among broken-fix CVEs, while server-side request forgery vulnerabilities were 4.6 times as common, according to Terra.<\/p>\n

This has to do with the way these types of bug classes are fixed: using a reject-list of inputs such as hostnames, paths, and object keys. There\u2019s a \u201csimple\u201d reason for this, according to Terra.<\/p>\n

\u201cIf the blocklist doesn’t foresee every encoding of a bad input, the attacker only needs to find one,\u201d the researchers said.<\/p>\n

Fixes for\u00a0Linux kernel vulnerabilities<\/a> are also more likely to cause new bugs, according to kernel CNA records as of October 8.<\/p>\n

\u201cIn fact, 3.2 percent of kernel CVEs were introduced by the fix for another CVE, and about 10 percent in busy subsystems like fs\/smb and net\/sched,\u201d the bug hunters noted.<\/p>\n

The silver lining in all of this, we\u2019re told, is that it should be a wake-up call for software vendors and network defenders to break the \u201cpatch and move on habit.\u201d Instead, before shipping patches, software vendors should consider three questions:<\/p>\n

Does it fix the root cause?\u00a0<\/p>\n

Does it cover the whole bug class?\u00a0<\/p>\n

Does it break something else?\u00a0<\/p>\n

And for sysadmins and patch managers: consider the same things before applying the fix. \u201cIf a vendor fixes an exploited bug, assume someone is reading the patch for a way around it,\u201d the pen testers advise. \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"patches Terra finds sharp rise in GitHub security fixes reported broken within 90 days Updating your software only…\n","protected":false},"author":2,"featured_media":808213,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[554,733,4308,86,56,54,55],"class_list":["post-808212","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/808212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=808212"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/808212\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/808213"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=808212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=808212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=808212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}