Incomplete security patches show hackers where to look next

A new analysis from Terra Security researcher Oren Yomtov finds that a growing number of software patches fail to fully close the vulnerabilities they target, effectively showing attackers exactly where to dig further. After reviewing published CVE records and GitHub security advisories, the team found that incomplete or bypassable fixes stayed rare and steady for years, then jumped roughly eightfold among open-source GitHub fixes in 2026. Patches for bugs already listed on CISA's Known Exploited Vulnerabilities catalog were about four times more likely to later be reported broken than other fixes from the same vendors, likely because exploited flaws attract more scrutiny from researchers hunting for what the patch missed. Flaws typically patched with input blocklists, such as SSRF and prototype pollution issues, were also overrepresented among broken fixes, as shown by Roundcube's webmail software, where an SSRF fix (CVE-2026-3554) needed three follow-up CVEs between May and August 2026, and by Microsoft's Windows Shell flaw CVE-2026-21510, exploited by APT28 and patched in February 2026, only for Akamai to find a bypass that Microsoft later fixed in April as CVE-2026-32202. Yomtov urges developers to stress-test their own patches for root-cause coverage before release, and advises defenders to keep probing systems even after vulnerability scanners report a clean bill of health.