Blog

Every post has at least one measured number and one runnable command.

• 2026-10-13

  Jenkins requires Java 21. What happens to your AIX 7.1 and RHEL 6 build hosts?

  Jenkins needs Java 21 on the controller and on every agent. AIX 7.1, Solaris and HP-UX cannot run it, so their teams stay on Jenkins 2.346.3. Where each Jenkins version is locked, the highest Java each legacy platform can run, with sources, and Agent8: a Jenkins agent that runs on Java 8.

• 2026-09-18

  Keycloak fixed a critical account-takeover bug. Three of its release streams can't install the fix.

  CVE-2026-18963 (CVSS 9.1) is fixed in 26.4.15, 26.6.6 and 26.7.2. Only one of those is a release you can download. On 26.4 and 26.6 the fix is a git tag with no artifact; on 26.2 it does not exist at all. Where the fix actually is, why your scanner may not tell you, and the tested way off each stream.

• 2026-09-01

  Keycloak 26.7.3 fixes 20 CVEs. Here's which ones can actually reach you.

  20 CVEs sounds like an emergency. We sorted all 20 by what has to be true for each to matter — plus the six non-security regressions living on 26.7.0-26.7.2 that the CVE count doesn't even cover — and mapped the tested path off both.

• 2026-08-26

  Zero-downtime Keycloak patch upgrades, measured: 156/156 probes

  We upgraded a 3-node HA Keycloak cluster while probing it every second: 156 probes, 156 × HTTP 200, and a pre-upgrade session that survived every node being replaced. The numbers, the orchestration, and the three mistakes we made.