Critical

VMSA-2026-0008.1 — Apply KB 460732 on 9.1.1 or KB 460734 on 9.0.x, 9.1.0 and 5.2.x today, restrict SDDC Manager to trusted admin hosts, and subscribe to the advisory for the patch.

Details →

Lab online · 1 · 78 posts

The Small
Human Cloud

Blog articles, news and useful information on VMware Cloud Foundation, automation and PowerShell — all from the home lab, where everything gets broken and rebuilt first.

Topology · mgmt domain All systems nominal
sddc-manager vcenter nsx vcf-ops esx-01 esx-02 esx-03 esx-04 vsan-datastore 4 hosts · healthy
Blog posts
78
vExpert since
2020
In IT since
2008
Days since I broke the lab
11

Latest News from the Web

All briefings →
Friday edition

Attackers are already going after the Brotli flaw behind Broadcom's SDDC Manager advisory

  • Put the Brotli workaround on SDDC Manager now that the flaw is reported as exploited. VMSA-2026-0008.1 still says "Patch pending" for every release. On 9.1.1, KB 460732 makes nginx and the UI server reject Brotli-encoded requests; the advisory points 9.0.x, 9.1.0 and 5.2.x to KB 460734. Keep SDDC Manager reachable only from trusted admin hosts, back it up before you change anything, and remove the workaround once the fixed runtime ships.
  • Make sure every ESX host has the fix for the logging flaw CVE-2026-41709. The VMSA-2026-0006 response matrix lists ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 for 8.0, and VCF 5.2.4 for VCF 5.x. Hosts patched only to 8.0 U2f aren't covered (that patch fixes only the VMXNET3 flaw), and The Hacker News reports CISA's federal deadline is 11 November.
  • Tomorrow is the AVS licence-included PayGo cut-off, and VCSP Commit starts on Sunday. Licence-included PayGo SKUs on Azure VMware Solution retire on 31 October and new VCSP contracts move to the Support Portal Licensing module from 1 November. Insight's booked VMware services also end tomorrow.
  • Security Exploitation reported
  • Releases & KBs All quiet
  • Terraform & Packer One correction
  • Next deadline 1 day
Read today's Latest Tech News →

Code Projects

VMware Explore 2024 Hackathon Winning team

Project and code from the Las Vegas hackathon at VMware Explore 2024.

Explore · Las Vegas 2024 Repo ↗

Simplify VCF Deployment & Operations with Terraform

Session code with examples for deploying VCF and common post-bring-up tasks.

Explore session · 2024 Watch ↗ Repo ↗

Automating VCF Day 1 Operations

Session code covering Day 1 actions via the API and PowerVCF.

Explore session · 2024 Watch ↗ Repo ↗

Presentations

Every slide deck and demo from the events I've been lucky enough to present at.

Decks & demo code Repo ↗
Thanks for visiting

Let's talk tech!

Questions, ideas, or just want to talk VCF? Drop me an email or find me on the socials.

Email me →