The Tech Leaders Brief

Terra reports more security fixes requiring follow-up advisories

2 selected stories, with article evidence, consequences and limits.

Read the analysis Explore the archive

About 2 minutes.

Research coverage: 6 of 6 candidate articles read. Analysis is model-generated; source links show its evidence.

Independent

According to Terra Security's research reported by The Register, the share of GitHub security fixes followed within 90 days by an advisory reporting patch failure rose from about 0.2% during 2019, 2025 to 2.3% in 2026.

Why it matters: For software vendors and vulnerability-management teams, patch installation may not resolve the exposure completely. The article reports that an incomplete Windows Shell patch left a second vulnerability that was exploited before another fix. Terra reports that vulnerabilities with bypassed fixes were about four times as likely to appear on CISA's Known Exploited Vulnerabilities list as other bugs affecting the same vendors.

Decision: For exploited vulnerabilities, keep follow-up advisory monitoring active after patch installation rather than treating installation as the end of remediation.

What remains uncertain: Terra is an AI penetration-testing startup; its underlying study was not supplied. These figures describe documented patch failures, not the failure rate of all deployed patches. Neither the trend nor the exploitation association establishes that AI caused the increase.

Read: Reported article: Security patches need patches now that attackers have AI

No linked primary source could be read; claims rely on the reporting above.

Procurement study challenges nationality as a proxy for cloud sovereignty

Independent

A newly reported ECIPE study examines 8,725 cloud-related procurement contracts from 2018, 2025 across nine EU countries. It finds procurement was already overwhelmingly domestic and says every contract invoking sovereignty went to a domestic provider. This challenges the planned CADA framework's prospective effects, rather than demonstrating a new procurement shift.

Why it matters: For public-sector technology buyers, a domestic supplier does not necessarily remove infrastructure dependencies: ECIPE says domestic prime contractors often rely on hyperscalers. Its concern is that national preferences could limit cross-border competition while preserving those dependencies.

Decision: When assessing sovereign-cloud bids, evaluate the underlying infrastructure and demonstrated ability to switch providers alongside applicable ownership and location requirements.

What remains uncertain: The underlying study was not supplied. The Commission describes four assurance levels selected through public-sector risk assessments and proposes common EU procurement, potentially countering fragmentation. CISPE argues that technology ownership and protection from extraterritorial laws matter substantively. CADA's eventual market effects remain unestablished by this evidence.

Read: Reported article: Europe's cloud sovereignty rules could do more harm than good; Primary source: Cloud and AI Development Act | Shaping Europe's digital future

Sources

Source types: Vendor Independent Regulator "Vendor claim, unconfirmed" means no independent or regulator item in this edition corroborates it.

Independent outlets scanned: iTnews, The Register, Ars Technica, BleepingComputer, Dark Reading, MIT Technology Review. Regulator source: CISA (US only). Not monitored: Cyber.gov.au (no reachable official feed), so there is no Australian regulator coverage.