UK — The Register
Security patches need patches now that attackers have AI
Security1 min read
Security patches (fixes that close software holes) are failing more often. A new report says the share of fixes that later needed another fix rose sharply in 2026, as AI helps attackers and bug finders work faster.
What happened
AI security startup Terra Security studied published security records. It found that more security fixes are being broken in 2026. A fix is 'broken' when attackers find a way around it. This had been rare for years, but it rose sharply this year.
Key numbers
- Between 2019 and 2025, about 0.2 percent of GitHub security fixes needed a follow-up report saying the fix failed within 90 days.
- In 2026, that number jumped to 2.3 percent.
- Bugs with broken fixes were about 4 times as likely to be on CISA's Known Exploited Vulnerabilities list (a list of bugs known to be used by attackers).
- Prototype-pollution bugs were about 11 times as common among broken-fix bugs. Server-side request forgery bugs were about 4.6 times as common.
- 3.2 percent of Linux kernel bugs were caused by the fix for another bug.
A real example
Russian government spies used a zero-day bug (a flaw nobody had fixed yet) in a Windows feature. Microsoft's first patch in February was incomplete. A second flaw was then found and used before Microsoft fixed it in April.
Why it matters
Most people update their software to stay safe. If the update itself has holes, people stay at risk. The researchers say software makers and IT staff should check whether a fix solves the root cause, covers the whole type of bug, and does not break anything else.
What to watch
- Whether software makers change how they write fixes, especially for prototype-pollution and server-side request forgery bugs.
- Whether the rise in broken fixes continues through the rest of 2026.
- How IT teams check patches before they install them.
Glossary
- Terra Security
- An AI penetration-testing startup, a company that tests computer systems for weak spots by attacking them the way hackers would.
- zero-day
- A security flaw that is used by attackers before the maker has a fix for it.
- CISA's Known Exploited Vulnerabilities list
- A US government list of security bugs that attackers are known to be using.
- prototype-pollution
- A type of coding bug where an attacker changes basic building blocks of a program in ways the program did not intend.
- server-side request forgery
- A bug where an attacker tricks a server into sending requests to places it should not reach.