September 2026 Product Pulse: a new Static Analysis engine and more

The September edition of the Veracode Product Pulse newsletter is here. This month's headline is Static Analysis Engine v2026.09, released September 23 and generally available.

• Fewer false positives. The engine reduces false positives for CWE-259 and CWE-798 flaws.
• DryRun Security integration. Hybrid findings combine Veracode deterministic static analysis with DryRun contextual AI, surfacing security context during pull request and code review workflows.
• Enhanced Python scanner. Support for PySpark, Flask, Django, and FastAPI. If your team scans Python, you may see a one-time change in flaw matching, and previously applied mitigations might need to be reapplied.

Also in this issue: Veracode Fix for SCA (Limited Availability), Reachability Analysis in the Unified SCA Beta UI, a redesigned EASM interface, Azure DevOps Extension v4.0.0, and a new Security Labs lesson on the OWASP Top 10 for LLM applications.

👉 Read the full September newsletter

Want the technical details now? See the Static Analysis release notes on Veracode Docs.