From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline
INFERA AI.SafeCode addresses the growing crisis in Application Security where traditional integration of separate SAST, DAST, and SCA tools produces hundreds of critical alerts, up to 80 percent of which are false positives.
The rapid adoption of AI coding assistants such as GitHub Copilot, Cursor, and Claude has multiplied both development speed and the volume of insecure code, turning AppSec into a bottleneck when legacy processes remain unchanged.
INFERA AI.SafeCode unites seven specialized engines under a single DevSecOps and MLSecOps framework: real-time SAST in IDE and CI/CD, SCA for open-source components and transitive dependencies, Secrets scanning with validity verification, DAST for running applications, an AI Pentest agent that simulates manual testing in a sandbox, Code Fuzzing for crash vulnerabilities, and API Fuzzing covering REST, GraphQL, gRPC, and WebSocket interfaces.
Results are normalized and deduplicated into a unified risk registry that automatically assigns high and critical issues to developers together with explanations, proof-of-exploit evidence, and remediation guidance.
Cross-validation between engines replaces manual triage. When SAST identifies a potential SQL injection, the platform automatically builds a targeted fuzzing harness; Code Fuzzing then attempts exploitation and returns a conclusive stack trace only if a crash occurs. Similarly, DAST detects authorization flaws such as IDOR by comparing responses across roles, after which the AI Pentest agent constructs attack graphs up to twelve steps deep to determine whether the issue can escalate to remote code execution.
Security checks run continuously inside the IDE, highlighting problems before commit and offering concrete AutoFix patches. Integration with GitLab and GitHub posts comments and ready pull requests directly on affected lines, while vibe-coded AI output is validated to prevent hallucinated vulnerabilities from entering the codebase.
API Fuzzing exercises stateful scenarios including authentication flows, mass assignment, JWT bypass, and malformed payloads using specifications such as OpenAPI, GraphQL schema, and .proto files. SCA analysis links vulnerable dependencies to actual code paths, distinguishing reachable CVEs from unused libraries, which is especially critical for organizations subject to Russian critical infrastructure regulations.
Secrets detection distinguishes test tokens from valid production credentials by performing live verification, converting potential noise into immediate incidents that trigger key revocation and investigation.
A centralized project view aggregates repositories, scan histories, attack-surface data, and metrics such as MTTR and SLA violations. The attack-surface module visualizes subdomains, open ports, endpoints, and entry-to-sink chains, giving CISO, AppSec, and development teams a shared, real-time picture of organizational risk.
Self-hosted deployment supports strict enterprise access controls and allows import of internal vulnerability databases to meet requirements of FSTEC Order No. 117, Order No. 21, GOST R 56939-2024, and Federal Law No. 152.
By confirming vulnerabilities before blocking pipelines and by providing reproducible evidence rather than raw alerts, INFERA AI.SafeCode enables development velocity while preventing uncontrolled growth of technical and security debt.
Related articles
Critical Vulnerabilities in PaperCut NG and PaperCut MF Exploited in the Wild
PaperCut Software has disclosed two serious vulnerabilities in its printing management solutions PaperCut NG and PaperCut MF. The issues were detailed in an advisory published on August 27, 2026, followed by emergency patches. Exploitation has already been confirmed in customer environments. CVE-2026-81578 stems from improper access controls in the web management interface, allowing unauthenticated remote changes to system settings. CVE-2026-82078 involves insecure dynamic class loading in database connections, enabling arbitrary Java bytecode execution with server privileges when combined with the first flaw. CVSS scores are 9.4 (Critical) and 8.8 (High) respectively, and both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities Catalog.
Positive Technologies Develops Dynamic Crawler for Single-Page Applications in PT BlackBox Scanner
Positive Technologies engineers have detailed the development of a dynamic crawler for their PT BlackBox DAST scanner to handle modern single-page applications built with frameworks such as React and Vue. The crawler must discover attack surface elements that only appear after user interactions because static parsing of initial DOM fails on SPAs where navigation occurs without URL changes. Key challenges include identifying interactive elements whose handlers are attached via JavaScript, detecting state changes after clicks or inputs, and managing combinatorial explosion of states caused by independent UI toggles. The team models the application as a labeled transition system and defines state equivalence using sets of 64-bit fingerprints of interactive elements rather than raw HTML similarity or URL values. This equivalence relation satisfies reflexivity, determinism from external observations, cheap hash-based comparison, slower growth than action count, and preservation of enabled actions across equivalent states. The approach allows the crawler to visit representatives of equivalence classes instead of every reachable state, keeping scans finite and practical within action budgets of several thousand interactions.
Over 8,300 Gitea Servers Remain Exposed to Remote Code Execution via CVE-2026-60004
Thousands of publicly accessible Gitea instances were still unpatched against CVE-2026-60004 as of late August 2026, leaving them open to remote command execution. The critical vulnerability combines abuse of the diffpatch endpoint with the ability to install and trigger attacker-controlled Git hooks, allowing unauthenticated attackers to run commands on the server. Exploitation requires only write access to a repository, which is often trivial due to default open user registration in many deployments. The issue was fixed in Gitea 1.27.1 released on July 27, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a remediation deadline of August 28 for U.S. federal agencies. In observed incidents, attackers used the access to deploy cryptocurrency miners inside Docker containers. A related authentication bypass affecting the official Docker image, CVE-2026-20896, was also noted when reverse-proxy headers such as X-WEBAUTH-USER are enabled.
Microsoft Defender Displays False 'Enable Virus Protection' Alerts on Windows Despite Active Real-Time Protection
Microsoft has confirmed a bug in Microsoft Defender that causes Windows to show persistent notifications urging users to enable virus protection even when the antivirus is already running with real-time protection active. The issue emerged after recent Defender updates and affects home users as well as enterprise environments running Windows 11 versions 23H2, 24H2, and 25H2, along with Windows 10 and Windows Server editions. Notifications appear at startup or during normal operation, ignore Do Not Disturb settings, and clicking them only opens the Windows Security app without resolving the alert. Microsoft is developing a fix to be released in a future Defender update but has not provided a timeline. Users are advised not to dismiss all such banners automatically, as similar messages could originate from malware, and should verify protection status through Windows Security or PowerShell commands. The problem stems from configuration errors introduced by the antivirus updates rather than specific Windows builds.