# Security Patches Fail More Frequently Due to AI-Driven Exploits AI-powered vulnerability discovery is enabling attackers to bypass incomplete software security fixes rapidly. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a4336d45-589b-4627-abe0-0afedb9bf156 ## Rising Patch Failure Rates Terra Security reports a significant increase in failed security patches during 2026. After maintaining a steady 0.2 percent failure rate between 2019 and 2025, the figure jumped to 2.3 percent this year. This trend suggests that attackers are increasingly identifying and exploiting bypasses in software fixes shortly after they are released. ## AI Accelerates Vulnerability Discovery The surge in patch failures coincides with the widespread adoption of AI for vulnerability research. Attackers now leverage automated tools to analyze security updates, finding ways to circumvent incomplete fixes. This shift marks a departure from previous years, where patch bypasses were relatively rare and required more manual effort from malicious actors. ## Case Study: Windows Zero-Day Russian cyberspies exploited the CVE-2026-21510 zero-day bug in Windows Shell a month before Microsoft issued a patch in February. The initial fix proved incomplete, leaving a secondary authentication coercion vulnerability, CVE-2026-32202, exposed. Attackers successfully abused this remaining flaw before Microsoft released a subsequent correction for the issue in April. ## High-Risk Vulnerability Classes Certain bug classes are more prone to broken fixes due to reliance on flawed mitigation strategies. Prototype-pollution vulnerabilities appear 11 times more frequently in broken-fix records, while server-side request forgery issues are 4.6 times more common. These failures often stem from using incomplete reject-lists that fail to account for all malicious input encodings. ## Linux Kernel Regression Risks Kernel development faces unique challenges regarding patch integrity. As of October 8, records indicate that 3.2 percent of kernel CVEs were actually introduced by previous security fixes. In complex subsystems like fs/smb and net/sched, this rate reaches 10 percent, highlighting the difficulty of implementing secure, non-breaking patches in highly active codebases. ## CISA List Correlation Vulnerabilities with bypassed fixes are four times more likely to appear on the CISA Known Exploited Vulnerabilities list compared to standard bugs. This correlation demonstrates that attackers prioritize these specific weaknesses, recognizing that a patch does not necessarily equate to total remediation when the root cause remains unaddressed by the vendor. ## Strategic Patching Requirements Vendors must move beyond the habit of shipping quick fixes without deep analysis. Before releasing updates, developers should evaluate if the patch addresses the root cause, covers the entire bug class, and avoids introducing new regressions. These three questions are essential for preventing the cycle of bypasses that currently plagues modern software security. ## Defensive Mindset Shift System administrators and security teams should adopt a skeptical approach toward vendor patches. When a vendor releases a fix for an exploited bug, defenders should assume attackers are already analyzing the code for bypass opportunities. Proactive verification of patches is now a critical component of maintaining a resilient and secure network infrastructure. ## Sources covering this story - https://www.theregister.com/patches/2026/10/19/security-patches-need-patches-now-that-attackers-have-ai/5303927 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._