Patched, and still open
A security fix is public: it says what was wrong, and where. Patch a flaw, miss its twin, and the fix becomes a map — the door you just closed, and the identical one you left open — handed to the intruder.
21 July 2026
A building has two doors fitted with the same lock, and the lock has a flaw. Someone finds it on the front door. A flaw like that cannot be kept quiet, so a public notice goes up naming exactly what is wrong, and the caretaker fits that door with a decent lock. The back door carries the identical lock, with the same flaw, and no one changed it. The notice that fixed the front tells anyone who reads it how to open the back.
A security fix is that notice. A patch, a public changelog, a numbered advisory: they announce, of necessity, what the flaw was and where it lived. And software is full of the same check written twice. A guard (does this certificate permit this? does this seal actually fit the message?) gets written once, then again a few functions over, for the near-identical case beside it. So a fix that lands on the reported copy, and stops there, publishes two things at once: the bug, and the whereabouts of its untouched twin.
A library behind a great many of the internet’s remote logins had exactly this. It offers two ciphers that do the same job, and each recomputes a small tamper-proof seal on every message that arrives: alter a byte in transit, and the seal no longer fits, the message is meant to be dropped. In one of the two ciphers the check was backwards — the library saw the seal did not fit and ran the message anyway — and that was found, and fixed, in public. The identical backwards check sat in the second cipher, one path over.
Patch a flaw, miss its twin, and the fix becomes a map #vulnerability-treasure
The fix told the whole story. It showed the exact mistake, and the correct guard beside it. Read the change, look one path over, and there is the same mistake, unfixed, with its own remedy sitting a few hundred lines up the same file. The repair, when it finally came, was that neighbouring guard copied across. It had existed all along. It had simply never been carried next door.
This is the inversion that makes it dangerous. A fix is meant to close a window of exposure; a partial fix on duplicated code opens one, because it hands the person who was never going to find the bug a confession and a forwarding address. The one who gains is not the tenant who updated in good faith. It is the one who read the notice and walked round the back. What the second door buys is narrow and exact: without reading a line of the encrypted traffic, an intruder can take a single message the machine was always going to send and rewrite it into a command of their own.
The patch is the wrong instrument for this. A patch lands where the report points, in public, and duplication is what lets it fix one door, publish the flaw, and leave the identical one open. The real fix is upstream of any patch: stop writing the check twice. Put the guard in the one place every path runs through, and a single repair reaches all of them at once, with nothing left behind for a changelog to advertise. The lock was never two different locks. Write the check once, and there is no second door to find. Read on →