From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline
INFERA AI.SafeCode addresses the growing crisis in Application Security where traditional integration of separate SAST, DAST, and SCA tools produces hundreds of critical alerts, up to 80 percent of which are false positives.
The rapid adoption of AI coding assistants such as GitHub Copilot, Cursor, and Claude has multiplied both development speed and the volume of insecure code, turning AppSec into a bottleneck when legacy processes remain unchanged.
INFERA AI.SafeCode unites seven specialized engines under a single DevSecOps and MLSecOps framework: real-time SAST in IDE and CI/CD, SCA for open-source components and transitive dependencies, Secrets scanning with validity verification, DAST for running applications, an AI Pentest agent that simulates manual testing in a sandbox, Code Fuzzing for crash vulnerabilities, and API Fuzzing covering REST, GraphQL, gRPC, and WebSocket interfaces.
Results are normalized and deduplicated into a unified risk registry that automatically assigns high and critical issues to developers together with explanations, proof-of-exploit evidence, and remediation guidance.
Cross-validation between engines replaces manual triage. When SAST identifies a potential SQL injection, the platform automatically builds a targeted fuzzing harness; Code Fuzzing then attempts exploitation and returns a conclusive stack trace only if a crash occurs. Similarly, DAST detects authorization flaws such as IDOR by comparing responses across roles, after which the AI Pentest agent constructs attack graphs up to twelve steps deep to determine whether the issue can escalate to remote code execution.
Security checks run continuously inside the IDE, highlighting problems before commit and offering concrete AutoFix patches. Integration with GitLab and GitHub posts comments and ready pull requests directly on affected lines, while vibe-coded AI output is validated to prevent hallucinated vulnerabilities from entering the codebase.
API Fuzzing exercises stateful scenarios including authentication flows, mass assignment, JWT bypass, and malformed payloads using specifications such as OpenAPI, GraphQL schema, and .proto files. SCA analysis links vulnerable dependencies to actual code paths, distinguishing reachable CVEs from unused libraries, which is especially critical for organizations subject to Russian critical infrastructure regulations.
Secrets detection distinguishes test tokens from valid production credentials by performing live verification, converting potential noise into immediate incidents that trigger key revocation and investigation.
A centralized project view aggregates repositories, scan histories, attack-surface data, and metrics such as MTTR and SLA violations. The attack-surface module visualizes subdomains, open ports, endpoints, and entry-to-sink chains, giving CISO, AppSec, and development teams a shared, real-time picture of organizational risk.
Self-hosted deployment supports strict enterprise access controls and allows import of internal vulnerability databases to meet requirements of FSTEC Order No. 117, Order No. 21, GOST R 56939-2024, and Federal Law No. 152.
By confirming vulnerabilities before blocking pipelines and by providing reproducible evidence rather than raw alerts, INFERA AI.SafeCode enables development velocity while preventing uncontrolled growth of technical and security debt.
Related articles
SonicWall Global Management System Hit by Critical RCE and Path Traversal Vulnerabilities
SonicWall has disclosed six vulnerabilities in its SonicWall Global Management System (GMS) management product, with the highest-severity issues rated Critical. The most severe flaw, CVE-2026-66147, resides in the Dispatcher Service and allows unauthenticated remote code execution through crafted requests that inject commands. A second critical issue, CVE-2026-66145, stems from improper handling of zip archive extraction and enables path traversal attacks that can read sensitive data or write arbitrary files without authentication. Both vulnerabilities received CVSSv3 base scores above 9.0. The flaws affect both the virtual appliance and Windows versions of GMS. SonicWall released an advisory on August 11 urging immediate application of the available updates.
Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities
Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.
Compromised SIM Cards Exploit Proactive SIM to Steal Files, Execute Code and Force 2G on Smartphones and IoT Devices
Researchers from the University of Birmingham and Fuzzware have demonstrated that a compromised SIM card can issue commands to smartphones and IoT devices by abusing the standard Proactive SIM feature. The attack leverages the RUN AT command to force the modem to execute AT commands, creating a direct channel from the SIM to the device hardware. Using their CATana toolkit, the team tested 18 smartphones and eight cellular IoT devices, finding the AT command interface exposed on two phones and seven IoT units. Four vulnerabilities were identified, enabling code execution, file theft, denial of service and persistent downgrade to 2G. Affected devices include the OPPO Reno14 F 5G and Quectel-based modules such as the EC25-AFX and EG25-G. Manufacturers have released some patches, and GSMA has registered the issue as CVD-2026-0122, though researchers recommend removing the RUN AT function entirely from firmware.
Russian Researchers Patent Detector Blinding Protection for Quantum Key Distribution Systems
Engineers from SFB Lab and the Center for Quantum Technologies at Moscow State University have developed a new method to protect quantum key distribution systems against detector blinding attacks. The technique not only detects the attack but also preserves the secure portion of the generated key instead of discarding the entire key after an alarm. The approach works by randomly varying the quantum efficiency of single-photon detectors at the receiver side, forcing an attacker to leave detectable traces such as erroneous or double clicks. These statistical anomalies allow the system to estimate the number of potentially compromised bits and remove them during privacy amplification. The solution has been granted Russian patent RU 2 856 208 C1 and accepted for publication in Physical Review Applied. It was validated on commercial off-the-shelf detectors and requires no changes to the optical scheme, making it compatible with a wide range of existing QKD hardware.