Incomplete security patches show hackers where to look next

Security patches are turning into roadmaps for attackers, with a growing of fixes later found incomplete or open to bypass.

Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year.

“A fix would ship, a bypass would be found, and another fix would go out. Worried this was sample bias, we looked at every published CVE record and every GitHub-reviewed advisory for one pattern: a fix ships, and a later advisory says it was incomplete or could be bypassed.”

“The data backed up our hunch,” he wrote . “Broken fixes have been reported for years at a low, steady rate until 2026, when the of open-source fixes on GitHub later reported broken rose eightfold.”

Exploited bugs and blocklist fixes break most often

Fixes for vulnerabilities on CISA’s Known Exploited Vulnerabilities catalog are later reported broken four times as often as fixes for other bugs from the same vendors. The likely reason, in Yomtov’s view, is attention, since exploited bugs draw more people who study the patch and find what it missed.

Bug classes where the usual fix is a list of blocked inputs, such as server-side request forgery (SSRF) and prototype pollution, show up far more often among broken fixes than among CVEs overall. When a blocklist doesn’t anticipate every form of a bad input, an attacker only needs to find one that gets through, Yomtov explained.

Roundcube, the open-source webmail software, is one example. In March 2026, its developers fixed an SSRF flaw ( CVE-2026-35540 ) by blocking links to private addresses, but the check missed other ways of writing the same address, along with domain names that resolve to it. Closing those gaps took three more CVEs, released in May, July and August.

Microsoft patched CVE-2026-21510 , a Windows Shell vulnerability the APT28 group was exploiting in the wild, in February 2026. Akamai later found the patch could be bypassed with a crafted Control Panel item that made Windows an attacker’s server and leak the user’s NTLM hash. Microsoft fixed the bypass in April as CVE-2026-32202, and that flaw also ended up on CISA’s exploited list. The new advisory makes no mention of the earlier CVE.

Advice for developers and defenders

A patch that only blocks the reported input can make a bug look addressed while it stays in the underlying code, Yomtov argued, and it shows attackers both the vulnerable code and the defender’s idea of what the bug was.

“Diff-hunt your own fix before shipping it, certainly before any attackers do,” he advised, urging developers to check whether a fix addresses the root cause and covers the whole bug class.

For organizations installing patches, Yomtov recommends assuming that when a vendor fixes an exploited bug, someone is reading that patch for a way around it, and to keep testing after a scanner reports no problems.