APAmaresh Pelletiindevtoolhub.hashnode.dev·4h ago · 1 min readGit 2.55: History Fixup, Rust by Default, Safer CheckoutsOriginally published on DevToolHub. Git 2.55 shipped June 29, 2026, with a build-requirement change that affects CI more than daily use: Rust is now required to build Git from source unless you opt o00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 4 min readThe Back-Office Break-In: Nine Dolibarr FindingsBy CodeAnt AI · Security Research We went hunting for the security flaws that matter in the software real businesses run every day. In Dolibarr, the open-source ERP behind the invoices, payroll and b00
AQAndrew Quilleninblog.andmaverick.com·3h ago · 4 min readProtected Is Not the Same Word as SuperiorI was in Paris. Eighth arrondissement. Someone at the table said the model is Chinese. We cannot trust it. What they were using instead cost four times more per inference call and was losing on their 00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 5 min readCVE-2026-71511 · Read a member's card, receive their password hashCVSS 6.5 · Sensitive data exposure (CWE-200) · Fixed in Dolibarr 24.0.0 Every reply is supposed to pass a redactor that blacks out secrets. The Users redactor blacks out the password. The Members reda00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 6 min readCVE-2026-71510 · Ask enough yes/no questions and you know everyone's salaryCVSS 6.5 · Authorization oracle → blind disclosure (CWE-863 / CWE-200) · Fixed in Dolibarr 24.0.0 You can't see the salary column, but the search box will happily answer “is this person's salary above00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 5 min readCVE-2026-71509 · Approve your own expenses — and your whole team'sCVSS 6.5 · Approval / access-control bypass (CWE-862) · Fixed in Dolibarr 24.0.0 The big “Approve” button correctly needs a manager. But the plain “edit this report” form lets you type approved and na00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 5 min readCVE-2026-71508 · Set your own salary — and the receipt hides itCVSS 6.5 · Mass assignment on payroll fields (CWE-915) · Fixed in Dolibarr 24.0.0 The form that updates your profile refuses to let you change your job title, but leaves “salary” wide open, then shows00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 5 min readCVE-2026-71506 · The wrong key on the lockCVSS 6.5 · Wrong-permission authorization (CWE-863) · Fixed in Dolibarr 24.0.0 The button labelled “delete a draft invoice” is wired to the vault that holds recorded payments. Press it and money that 00
AJAmartya Jhainsecurity-research.hashnode.dev·5h ago · 5 min readCVE-2026-71505 · The read desk checks your ID. The write desk doesn't.CVSS 8.1 · Broken object-level authorization (CWE-639) · Fixed in Dolibarr 24.0.0 The clerk who shows you a file first checks it's yours. The clerk who resets the password on that file never checks, s00
OZOliver Zehentleitnerinblog.technopathy.club·1d ago · 15 min readSame Skill, Six Agents, Nine Models: What a Real Eval Matrix Taught MeI tested Keep the Why, my open-source agent skill for preserving the reasoning behind a codebase, through six coding agents, with a matrix spanning nine hosted models plus a local Ollama run. The mode20
