Fixed Detectors, Moving Code: How Well Do Static Security Analyzers Hold Up over a Decade of C/C++ Evolution?

Reported by arXiv cs.CR (Junhua Tang, Zhengsong Zhang. Haipeng Cai)

Summary by Cyber Security News4 Nov 2026, 06:00 CET

About this summary. This is a short excerpt from the description that arXiv cs.CR published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://arxiv.org/abs/2611.03742

arXiv:2611.03742v1 Announce Type: new Abstract: Static application security testing (SAST) tools are often deployed on the assumption that detectors configured today will remain effective on future code, including previously unknown vulnerabilities. We test this assumption using 20,000 vulnerable and fixed C/C++ cases from 1,116 open-source projects (2016-2025), evaluated with three CodeQL releases, three Infer releases, and one Semgrep configuration.

Read the full article at arXiv cs.CR →

Source attribution: headline and facts are from arXiv cs.CR (arxiv.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation

CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables

CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal

CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM

CVE-2026-108946: Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection