Lab offline · Awaiting Parts... · 9.1.1 · 78 posts
The Small
Human Cloud
Blog articles, news and useful information on VMware Cloud Foundation, automation and PowerShell — all from the home lab, where everything gets broken and rebuilt first.
- Blog posts
- 78
- vExpert since
- 2020
- In IT since
- 2008
- Days since I broke the lab
- 10
Deploying VMware vSphere Foundation (VVF) 9.1 in a Lab
Guest post · James Tiffany
When it comes to installing your VVF environment you have two options available. The first, and most common, is to use the VCF Installer. Don't let the name faze you, the same installer that deploys VCF will also deploy VVF for you. The great thing about doing it this way is the level of automation you get, this process will deploy vCenter, VCFMS, VCF Operations and the License server...
Installing and Activating VMware Intelligent Assist in VCF Operations
So last week during VMware Explore in Las Vegas, a new feature was announced, VMware Intelligent Assist!
Latest News from the Web
Reports say attackers used an ESX logging flaw to hide their tracks
- Check that every ESX host is on a build that fixes CVE-2026-41709, the logging flaw now reported as exploited. The VMSA-2026-0006 response matrix lists ESXi-9.1.0.0-25370933 for 9.1, ESXi-9.0.2.0100-25595025 for 9.0, ESXi80U3j-25429389 for 8.0 and VCF 5.2.4 for VCF 5.x. The catch is that the 8.0 U2f patch some of you used for the critical fixes isn't listed for this CVE, and for VCF 5.x the matrix lists VCF 5.2.4 rather than the async patch route used for the critical fixes. The Hacker News reports CISA's federal deadline is 11 November.
- Keep SDDC Manager behind your admin networks and use the Brotli workaround until a patch lands. VMSA-2026-0008.1 still says "Patch pending" for every release. On 9.1.1, KB 460732 makes nginx and the UI server reject Brotli-encoded requests; the advisory points 9.0.x, 9.1.0 and 5.2.x to KB 460734. Back up the appliance first and remove the workaround once the fixed Node.js runtime ships.
- Make sure ESX logs and audit records leave the host. A flaw that skips local logging is far less useful to an attacker if a remote collector already holds the record. Audit records are off by default; today's deep dive covers the Syslog.global.auditRecord settings and the gotchas.
- Security Exploitation reported
- Releases & KBs All quiet
- Terraform & Packer One bug to know
- Next deadline 2 days
Code Projects
VMware Explore 2024 Hackathon Winning team
Project and code from the Las Vegas hackathon at VMware Explore 2024.
Simplify VCF Deployment & Operations with Terraform
Session code with examples for deploying VCF and common post-bring-up tasks.
Automating VCF Day 1 Operations
Session code covering Day 1 actions via the API and PowerVCF.
Presentations
Every slide deck and demo from the events I've been lucky enough to present at.