Terra Security: Reported broken security patches surge in 2026 as AI accelerates bug discovery and patch bypasses
AI pen-testing startup Terra Security reports a sharp rise in security fixes later found to be bypassed or incomplete. The share of GitHub security fixes needing a follow-up advisory for a failed patch within 90 days held near 0.2% from 2019 to 2025 but jumped to 2.3% in 2026. Terra links the trend to the 2026 explosion in AI-driven vulnerability discovery and patching. Vulnerabilities whose fixes were later bypassed were about four times as likely to appear on CISA's Known Exploited Vulnerabilities list as other bugs affecting the same vendors.
A cited example: Russian government cyberspies exploited the Windows Shell security bypass zero-day CVE-2026-21510 at least a month before Microsoft's February patch. That patch was incomplete and left CVE-2026-32202, a zero-click authentication coercion flaw, which was also exploited before an April fix.
Technical Details
- Server-side request forgery (SSRF) and prototype-pollution fixes break most often. Prototype pollution was about 11x over-represented among broken-fix CVEs and SSRF 4.6x, relative to their share of all CVEs.
- The cause is reject-list (blocklist) fixes for hostnames, paths and object keys; if the list misses one encoding of bad input, the attacker only needs to find that one.
- Per kernel CNA records as of October 8, 3.2% of Linux kernel CVEs were introduced by the fix for another CVE, and about 10% in busy subsystems such as fs/smb and net/sched.
Remediation
- Vendors should ask before shipping: does the patch fix the root cause, does it cover the whole bug class, and does it break something else?
- Defenders should weigh the same questions and assume that when an exploited bug is fixed, someone is reading the patch to find a bypass. Apply patches but verify and monitor for follow-up advisories.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-32202. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Microsoft - NTLMv2 Hash Capture
This script targets a Windows Shell (File Explorer) spoofing flaw, CVE-2026-32202, by generating a shortcut (.lnk) whose path points to an attacker-controlled SMB server. The attacker must place the file in a folder the victim browses, and the victim's machine must reach the attacker's SMB service; no click is claimed, only viewing the folder. The outcome is a leaked NetNTLMv2 hash that can be cracked or relayed. It is a rough, unverified proof of concept: the hand-built file looks crude and may not trigger reliably.
Linha do tempo
-
Terra Security: Reported broken security patches surge in 2026 as AI accelerates bug discovery and patch bypasses
ler a análise desta fonte ocultar
AI pen-testing startup Terra Security reports a sharp rise in security fixes later found to be bypassed or incomplete. The share of GitHub security fixes needing a follow-up advisory for a failed patch within 90 days held near 0.2% from 2019 to 2025 but jumped to 2.3% in 2026. Terra links the trend to the 2026 explosion in AI-driven vulnerability discovery and patching. Vulnerabilities whose fixes were later bypassed were about four times as likely to appear on CISA's Known Exploited Vulnerabilities list as other bugs affecting the same vendors.
A cited example: Russian government cyberspies exploited the Windows Shell security bypass zero-day CVE-2026-21510 at least a month before Microsoft's February patch. That patch was incomplete and left CVE-2026-32202, a zero-click authentication coercion flaw, which was also exploited before an April fix.
Technical Details
- Server-side request forgery (SSRF) and prototype-pollution fixes break most often. Prototype pollution was about 11x over-represented among broken-fix CVEs and SSRF 4.6x, relative to their share of all CVEs.
- The cause is reject-list (blocklist) fixes for hostnames, paths and object keys; if the list misses one encoding of bad input, the attacker only needs to find that one.
- Per kernel CNA records as of October 8, 3.2% of Linux kernel CVEs were introduced by the fix for another CVE, and about 10% in busy subsystems such as fs/smb and net/sched.
Remediation
- Vendors should ask before shipping: does the patch fix the root cause, does it cover the whole bug class, and does it break something else?
- Defenders should weigh the same questions and assume that when an exploited bug is fixed, someone is reading the patch to find a bypass. Apply patches but verify and monitor for follow-up advisories.