Terra: share of broken security patches jumped to 2.3% in 2026

Terra Security found that the share of GitHub security fixes requiring a follow-up advisory within 90 days rose from about 0.2% in 2019–2025 to 2.3% in 2026. Vulnerabilities with bypassed fixes are roughly four times more likely to land on CISA's Known Exploited Vulnerabilities list, with SSRF and prototype-pollution patches breaking most often.

• Broken GitHub fixes rose from 0.2% to 2.3% in a year
• Bypassed fixes are 4x more likely to reach CISA's KEV list
• SSRF patches break 4.6x more often than average, prototype pollution 11x
• 3.2% of Linux kernel CVEs were introduced by fixes for other CVEs