Security patch developers, what can go wrong?

If you've ever developed security patches for any kind of software, I'd like to hear from you. How can patch development go wrong? Have patches ever introduced new vulnerabilities? Have cyber threat actors ever used your certificates or found other ways to deploy malicious patches that imitate your vendor/organization?

cybersecurity developers go patch security