Tag
secret-rotation
Articles tagged with secret-rotation.
security
22 min read
PHP2Shell (CVE-2026-109618): Patch PHP, Rotate Login Secrets
PHP2Shell (CVE-2026-109618, CVE-2026-109619): unauthenticated RCE in PHP. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Patch order, mitigations, what to rotate.
22 min readkeycloak-operations8 min read
Keycloak Client Secret Rotation in 26.8: How It Works
Keycloak 26.8 makes client secret rotation supported: two secrets overlap during a rotation, but nothing rotates on a timer and…
8 min readsecurity12 min read
MCP Python SDK OAuth Flaw: Pin the Issuer on Keycloak
MCP OAuth flaw GHSA-qx49-fqc8-xw99: a malicious server could steal client secrets and PKCE verifiers from the MCP Python SDK. Upgrade,…
12 min readsecurity12 min read
JADEPUFFER and Storm-3168: Retire Static Keycloak Secrets
Storm-3168 (JADEPUFFER) wiped Azure resources with compromised service principals. How the same client secret risk looks on Keycloak, and how…
12 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.