Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
A project required centralized authentication and authorization for 25,000–30,000 active users distributed nationwide, demanding strong scalability and reliability. The team selected Keycloak and rejected a single instance because it could not meet throughput or SLA targets. They therefore built a three-node cluster on isolated virtual machines using Embedded Infinispan and JGroups.
Kubernetes was considered excessive for the environment. The chosen architecture placed each Keycloak node in a separate data center, shared a PostgreSQL database clustered with Patroni, and enabled cache mode ispn so sessions replicate across nodes. TCP ports 7800 and 57800 were opened between the VMs for Infinispan communication and failure detection.
Each node registers its address in the JGROUPS_PING table at startup, allowing dynamic membership without static TCPPING lists. The JVM flag -Djgroups.external_addr and explicit node-name entries in cache-ispn.xml ensured correct visibility of external IPs and hostnames across data centers.
Failover tests included node restarts, database connectivity loss, and complete data-center isolation. When only Keycloak nodes lost connectivity while the database remained reachable, the cluster recovered automatically. Full data-center outages, however, produced split-brain states, multiple coordinators, and persistent 5xx errors. The built-in healthcheck did not detect the condition even after an upgrade that added cluster-specific checks.
A temporary Python watcher was deployed beside each container. It polled health endpoints and the JGROUPS_PING table, restarting any node that appeared as an extra coordinator. The root cause was reported in GitHub issue 45980; Keycloak developers acknowledged the bug and shipped a fix. After verification on test and staging environments, the production cluster was updated and now tolerates single data-center failure without session loss.
Related articles
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL
Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophos’s bug bounty program by an external researcher.
PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network
Israeli security firm Dream disclosed a sophisticated campaign that achieved root access on 25 servers by chaining two remote code execution vulnerabilities in PHP2Shell with a Linux kernel flaw. The attackers targeted 24 perimeter firewalls from a single unnamed vendor plus one internal management server across the United States, Japan, Taiwan, and South Korea. Three of the compromised devices belonged to an environment connected to the US government, where the intrusion led to domain controller access and Active Directory enumeration. The attack chain began with CVE-2026-109618 and CVE-2026-109619, which granted initial web server access, and escalated via CVE-2026-46300 (Fragnesia) to obtain root privileges. Dream observed extensive reconnaissance using the Chinese search engine FOFA, with indicators pointing to Chinese-language tooling and timing, though no specific threat actor was attributed.
Threat Actors Exploit Critical CVE-2026-101767 RCE Flaw in Oracle E-Business Suite
Threat intelligence firm Defused detected active exploitation attempts against CVE-2026-101767 targeting Oracle E-Business Suite honeypots on October 27, 2026. The vulnerability carries a CVSS 3.1 score of 9.8, requires no authentication, and resides in the Thin Client Framework servlet within the Application Object Library component. Oracle released a fix seven days earlier in its October 2026 Critical Patch Update, covering versions 12.2.3 through 12.2.15. Successful exploitation grants SQL execution under the privileged APPS database account, enabling lateral movement to operating system commands and access to financial, payroll, and procurement records. Horizon3.ai privately reported the issue in July 2026, and prior similar flaws in the same product were leveraged by the Cl0p ransomware group. Immediate mitigation includes applying the quarterly patch or restricting access to the GanttDataServer servlet via URL firewall rules.