patching
Articles tagged with patching.
PHP2Shell (CVE-2026-109618): Patch PHP, Rotate Login Secrets
PHP2Shell (CVE-2026-109618, CVE-2026-109619): unauthenticated RCE in PHP. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Patch order, mitigations, what to rotate.
22 min readKeycloak CIBA Lockout Fix: Brute-Force Check Added to Token Redemption
Keycloak 26.7.5 closes a gap where a locked-out user's approved CIBA request could be redeemed for tokens. Who is affected,…
7 min readKeycloak 26.7.4 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.4 fixes six CVEs, from a SAML memory leak to impersonation of realm admins. Which reach 26.6 and 26.4,…
10 min readCVE-2026-79651: Keycloak Unauthenticated Locale Cache DoS
CVE-2026-79651 lets anyone exhaust Keycloak heap via a public theme localization endpoint. It is fixed in 26.7.4, 26.6.7 and 26.4.16.…
10 min readCVE-2026-17526: Keycloak Impersonation Escalates to Realm Admin
CVE-2026-17526 let a Keycloak impersonation-role holder take over a realm admin. Fixed in 26.7.4 on 16 September 2026, and on…
8 min readKeycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…
9 min readCVE-2026-16072 and CVE-2026-18201: Two Keycloak Organization Permission Gaps
Two moderate Keycloak CVEs let admins act outside their permissions on organizations. What they allow, who is affected, and what…
7 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.