Key points
- The rate of GitHub fixes requiring follow-up advisories within 90 days rose to 2.3% in 2026.
- Prototype pollution and server-side request forgery patches are disproportionately likely to fail.
- Broken fixes are four times more likely to appear on CISA’s Known Exploited Vulnerabilities list.
Attackers now face a shorter window of safety after vendors issue security updates. Research from Terra Security indicates that a growing number of GitHub security fixes are being bypassed within 90 days of release. This trend suggests that applying a patch no longer guarantees long-term protection against newly discovered weaknesses in the same codebase.
In plain English
For years, the share of GitHub security fixes that needed a follow-up correction remained steady at roughly 0.2 percent. In 2026, however, this figure jumped to 2.3 percent. Terra researchers found that after a fix ships, attackers often find a bypass before a second fix is deployed. This cycle of broken patches is becoming more common.
The background
Terra reviewed every published CVE record and GitHub advisory to identify this pattern. The study found that vulnerabilities with broken fixes are about four times more likely to appear on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities list compared to other bugs from the same vendors. This highlights the increased risk associated with incomplete remediations.
What changes now
Specific vulnerability classes are proving harder to fix correctly. Prototype pollution patches were 11 times more common among broken fixes than their share of total CVEs would suggest. Server-side request forgery fixes were 4.6 times more common. An example cited is a Windows Shell bypass exploited by Russian spies before Microsoft issued an incomplete patch in February 2026.
The attacker's path
Teams usually monitor for new advisories related to recently patched components rather than assuming the initial fix is final. Check whether your inventory includes software with a history of rapid follow-up patches. Focus on validating that the underlying logic flaw was addressed, not just the specific exploit path. Verify that no residual access remains after installation.
Background: Prototype pollution
Prototype pollution is not a simple injection flaw. It corrupts object prototypes, affecting all instances. Input sanitisation often fails because the attack vector is structural, not just data-based. You must treat deserialisation and deep merging as high-risk operations requiring strict schema validation.
Read the full guide: Prototype Pollution Myths: Why Standard Defences Fail
What to do and how to stay safe: Terra Security
- Monitor vendor advisories for follow-up patches within 90 days of initial fixes.
- Prioritise patching prototype pollution and server-side request forgery vulnerabilities.
- Cross-reference installed software against CISA’s Known Exploited Vulnerabilities list.
- Review internal logs for signs of exploitation attempts on recently patched systems.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much did the rate of broken GitHub patches increase in 2026?
The share of fixes requiring a follow-up advisory within 90 days rose from 0.2 percent to 2.3 percent.
Which vulnerability types are most likely to have broken fixes?
Prototype pollution and server-side request forgery fixes are disproportionately common among broken patches.
Are broken fixes more likely to be actively exploited?
Yes, vulnerabilities with bypassed fixes are four times more likely to appear on CISA’s list.
