Updating your software only gets you so far. A scary scenario - security fixes themselves being bypassed - is becoming more common, according to AI penetration-testing startup Terra Security, which found a sharp rise in reported patch failures in 2026 after years of relatively low numbers. And no, it’s not a coincidence that AI vulnerability discovery and patching also exploded this year. For example, Russian government cyberspies exploited a zero-day Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched the flaw in February. Redmond’s patch, however, was incomplete, and left a second flaw - a zero-click authentication coercion vulnerability (CVE-2026-32202) - that was also found and abused before Microsoft fixed it in April. Terra researchers reviewed every published CVE record and GitHub-reviewed advisory looking for broken fixes, and found a distinct pattern. After six years of relatively few patch bypasses, this changed in 2026: “A fix would ship, a bypass would be found, and another fix would go out.” The share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained at about 0.2 percent between 2019 and 2025. This year, this figure had jumped to 2.3 percent, according to the researchers. Meanwhile, vulnerabilities whose fixes were later bypassed were about four times as likely to appear on the US Cybersecurity and Infrastructure Security Agency's (CISA's) Known Exploited Vulnerabilities list as other bugs affecting the same vendors, according to Terra. Of these, server-side request forgery fixes and prototype-pollution patches break the most. Compared with their share of all CVEs, prototype-pollution vulnerabilities were about 11 times as common among broken-fix CVEs, while server-side request forgery vulnerabilities were 4.6 times as common, according to Terra. This has to do with the way these types of bug classes are fixed: using a reject-list of inputs such as hostnames, paths, and object keys. There’s a “simple” reason for this, according to Terra. “If the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one,” the researchers said. Fixes for Linux kernel vulnerabilities are also more likely to cause new bugs, according to kernel CNA records as of October 8. “In fact, 3.2 percent of kernel CVEs were introduced by the fix for another CVE, and about 10 percent in busy subsystems like fs/smb and net/sched,” the bug hunters noted. The silver lining in all of this, we’re told, is that it should be a wake-up call for software vendors and network defenders to break the “patch and move on habit.” Instead, before shipping patches, software vendors should consider three questions: Does it fix the root cause? Does it cover the whole bug class? Does it break something else? And for sysadmins and patch managers: consider the same things before applying the fix. “If a vendor fixes an exploited bug, assume someone is reading the patch for a way around it,” the pen testers advise. ®

CISA has ordered US federal agencies to patch two exploited flaws in TrueConf, a Russian-built video conferencing platform, after compromised servers were caught handing malware to unsuspecting meeting participants. The US cybersecurity agency on Thursday added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog, saying both have been used in real-world attacks. What CISA doesn't say is who is being attacked, or where. The only publicly documented attacks exploiting these two bugs so far come from Kaspersky, which linked them to Head Mare, a pro-Ukrainian hacktivist group that has repeatedly gone after Russian organizations. Its latest campaign targeted Russian companies across industries including transport, energy, electronics, IT, and software development. CISA doesn't say whether it added the flaws to KEV because of those attacks or because it has evidence of exploitation elsewhere, potentially including against organizations in the US. That question is particularly interesting given what TrueConf is and who uses it. TrueConf is a Moscow-based maker of video conferencing software that offers an on-premises alternative to cloud services such as Zoom and Microsoft Teams. Organizations can run TrueConf Server on their own infrastructure, including in private networks, giving them control over where their calls and associated data go. While the company's roots and much of its customer base are Russian, TrueConf has users worldwide. It says it has users in its portfolio that include Switzerland’s Department of Justice and Home Affairs, Istanbul Airport, and a news org, which The Reg has contacted to confirm. Most of the customer success stories are dated before 2022. Used together, the two bugs flagged by CISA can give an attacker control of the underlying server. According to Kaspersky, an unauthenticated attacker with network access to TCP port 4307, which TrueConf documentation says is open by default, can exploit the first flaw to run a malicious script. The second flaw lets the attacker break out of the isolated environment where the script runs and execute arbitrary code on the underlying server. Kaspersky says Head Mare used that access to plant a web shell, move through victims' infrastructure, and gain privileged access to the TrueConf database. From there, the attackers replaced the legitimate TrueConf Windows client installer on compromised servers with a trojanized version carrying the PhantomCore backdoor. Kaspersky warns that this creates a risk beyond organizations actually running vulnerable TrueConf servers. Employees joining conferences hosted by suppliers or other third parties could potentially download a compromised client from someone else's hacked infrastructure. The researcher says the flaws affect TrueConf Server releases going back to 2022. TrueConf shipped fixes in versions 5.3.9, 5.4.9 and 5.5.5 on June 18, warning customers that skipping the update could leave their conferencing systems exposed to attacks over the public internet. That doesn't mean every TrueConf box is sitting on the internet waiting to be popped. Exploitation requires network access to the vulnerable service, so a server confined to an internal network would not be directly reachable from outside unless an attacker had another route in. Federal agencies have until September 10 to patch the flaws. Other TrueConf admins can take their time, as long as they're comfortable with a conferencing server potentially moonlighting as a malware distribution point. ®