Blog

Every post has at least one measured number and one runnable command.

• 2026-09-01

  Keycloak 26.7.3 fixes 20 CVEs. Here's which ones can actually reach you.

  20 CVEs sounds like an emergency. We sorted all 20 by what has to be true for each to matter — plus the six non-security regressions living on 26.7.0-26.7.2 that the CVE count doesn't even cover — and mapped the tested path off both.

• 2026-08-26

  Zero-downtime Keycloak patch upgrades, measured: 156/156 probes

  We upgraded a 3-node HA Keycloak cluster while probing it every second: 156 probes, 156 × HTTP 200, and a pre-upgrade session that survived every node being replaced. The numbers, the orchestration, and the three mistakes we made.