← Today's briefing
Briefing archive
23 daily briefings on what shipped, what broke and what needs patching across the VMware world. Subscribe via RSS.
November 2026
- vsphere provider 2.18.0 lands, bringing Supervisor namespaces fully into Terraform The vsphere Terraform provider 2.18.0 arrived yesterday, and it's the release to look at if you manage Supervisor namespaces as code. vsphere_namespace gains zones, user and group permissions, per-policy storage limits, NSX VPC or vSphere network backing and import, there's a new Supervisor data source, and the retry_timeout fix for network lookups is in. It also swaps storage_policies for storage_policy blocks, so read the upgrade notes before you lift your version pin. There's no new VMSA today, and SDDC Manager is still waiting for its Brotli patch, with the press-reported US federal deadline falling today. At KubeCon, Broadcom has contributed its VM API to the CNCF Sandbox and validated more than 20 new partner solutions for VKS. William Lam shows how to check VCF download checksums by hand, Unexplored Territory talks to John Nicholson about the new VCF Readiness Assessment Tool, and today's deep dive walks through building vSphere Namespaces with the new provider release. Today 4 critical
- A quiet start to KubeCon week, and how to get NSX TEPs and MTU right first time It's a quiet Monday for VMware news. The newest VCF 9.1.1 patches on TechDocs are still the October set, no new VMware KBs have appeared, and the Terraform providers and Packer plugins haven't released anything. KubeCon North America opens in Salt Lake City today, so this is the week to watch for VKS news from Broadcom's booth sessions. There's no new VMSA today. SDDC Manager is still waiting for its Brotli patch, so keep the workaround in place, especially with tomorrow's press-reported federal deadline. Elsewhere, Channel Dive has the first real detail on how vSphere Express is sold, and the vsphere Terraform provider has a fix queued for a network lookup retry that hasn't worked since 2.14.0. Today's deep dive is on NSX tunnel endpoints in VCF 9.x: the MTU rules, sharing a VLAN between host and Edge TEPs, and the settings you can't change once an Edge is deployed. 4 critical
- A quiet Sunday before KubeCon, and how VCF 9.1 backs up its own management stack It's a quiet Sunday. Nothing new has landed on TechDocs since the 26 October patches, no new VMware KBs have appeared, and the Terraform providers and Packer plugins haven't moved. The week ahead is busier: KubeCon starts in Salt Lake City on Monday, and the press-reported US federal deadlines for the SDDC Manager Brotli flaw and the ESX logging flaw fall on Tuesday and Wednesday. There's no new VMSA today; SDDC Manager is still waiting for its Brotli patch, and vCenter CVE-2026-59310 is still the one to patch first. Outside VMware, Help Net Security reports the OpenSSH "SSHole" flaw is now being exploited, though only on musl-based systems such as Alpine. Today's deep dive looks at how VCF 9.1 backs up its management components, and why getting the SFTP target right matters before your next patch run. 4 critical
- A quiet weekend start: KB 457944 finally names its fix, and vmware_rest 5.1.0 is out It's a gentle start to the weekend, with one change that will please anyone stuck mid-upgrade. KB 457944, the article about Supervisor control plane VMs disappearing from inventory after an upgrade to VCF 9.1 or 9.1.1, now names its fix: 9.1.1.0100, build 25784172, the vCenter and Supervisor patch level from 12 October. If you were waiting on that KB before upgrading, you can stop waiting. There's no new VMSA today, and SDDC Manager is still waiting for its Brotli patch, so keep the workaround in place. Elsewhere, Ansible's vmware.vmware_rest collection shipped 5.1.0 with a couple of deprecations, Virtually Speaking has a new episode on KubeVM Service, and today's deep dive looks at Protection and Recovery in VCF 9.1, the product you may still know as Live Recovery. 4 critical
- Europe's extra year on vSphere 8 draws scrutiny, and the week ends without new patches The story people are still talking about is the paragraph Broadcom added to Wednesday's portfolio post: in the European Economic Area, vSphere Standard 8 and Enterprise Plus 8 stay on sale until 31 October 2027, with extended support in active subscriptions until 31 October 2028 at the latest. Network World and The Register both read it as a concession to European regulators. It doesn't cover the UK or Switzerland, and Broadcom hasn't said what extended support includes, so don't build a plan on 2028 until you have the terms in writing. There's no new VMSA today, and SDDC Manager is still waiting for its Brotli fix, so keep the workaround in place. Otherwise it's a calm end to the week: no new VCF patches or VMware KBs, and the only provider change is a maintenance release of the vsphere provider, 2.17.2, while a vmware.vmware_rest release with deprecations is in review. As it's Friday, the week's top five come first, and the longer deep dive looks at bringing up VCF 9.1.1 as code, from the VCF Installer's JSON specification to the vcf_instance Terraform resource. 4 critical
- Broadcom brings back a standalone vSphere: vSphere Express, for up to 128 cores The VMware product most smaller shops have been waiting for has arrived. In its 4 November portfolio update, Broadcom introduced vSphere Express: vSphere 9 on its own, for customers with up to 128 cores, with vMotion, HA, the distributed switch, vCenter Quick Patch and TPM 2.0 and vTPM 2.0 support. Broadcom hasn't published a price. If you look after branch sites, small clusters or a lab and didn't want VVF or VCF, this is now a proper option, and in the European Economic Area vSphere Standard 8 and Enterprise Plus 8 also stay on sale until 31 October 2027. There's no new VMSA today, and the Brotli workaround on SDDC Manager is still the first job while its fixes stay "Patch pending". The same update sets out what's coming in the next VCF release, including S3-compatible object storage on vSAN, VPC policy-based connectivity and native disaster recovery, and adds VMware Compliance and Configuration Management to the list of Advanced Services. On the automation side, the vmware.vmware Ansible collection reached 2.13.0 overnight, and today's deep dive looks at how VCF Automation's three nodes, seven IP addresses and two FQDNs fit together. 4 critical
- VMware Cloud on AWS is moving to 9.1 in 2027, and both Packer plugins get an update Broadcom has set out how VMware Cloud on AWS moves to 9.1. Per the VCF blog, there will be a nomination-only early access phase, general availability is expected some time in 2027, and fleet upgrades of existing SDDCs (including those on 1.26) follow soon after, with no option to stay on the older release. If you run VMC alongside an on-premises VCF 9.1 fleet, it means both sides should end up on the same generation. There's no new VMSA today, and the Brotli workaround on SDDC Manager is still the first job while every fix stays "Patch pending". On the automation side, packer-plugin-vsphere 2.5.1 and packer-plugin-vmware 2.1.7 arrived yesterday as tidy maintenance releases, the Tanzu Mission Control provider reached 1.4.12, and three more namespace changes merged ahead of vsphere provider 2.18.0. Elsewhere, the EU General Court has let CISPE keep its backers' names from Broadcom, and today's deep dive untangles fleets, instances and domains in VCF 9.1. 4 critical
- Telco Cloud Platform folds into VCF, and an open-source stand-in for VDDK appears Broadcom has folded Telco Cloud Platform into VMware Cloud Foundation. As the VCF blog explains, the standalone Telco Cloud Platform licensing SKUs reached End of Availability yesterday, 2 November, and telco features now come through the ordinary VCF licence and SKU. If you run Telco Cloud Platform there's nothing to do today, since current subscriptions stay supported, but expect the conversation about moving to VCF at your next renewal. There's no new VMSA today. SDDC Manager is still waiting for its Brotli patch, so the interim workaround remains your protection. Elsewhere, The Register reports on OpenVDDK, an Apache-licensed, read-only stand-in for the VDDK library that migration tools lost access to in August, and Broadcom has a fuller write-up of VKS 3.8. There's nothing new on TechDocs or from the Terraform providers, Virtually Speaking has a new episode, and today's deep dive looks at planning a VKS 3.8 upgrade with chained cluster upgrades. 4 critical
- A calm Monday: VMware Tools 13.1.6 is out, and SDDC Manager still waits for its Brotli fix It's a gentle start to the week. The one new release is VMware Tools 13.1.6, out since Friday 30 October, which adds Capsule PK Update driver support for older Windows guests and some unspecified security enhancements. Nothing else moved on TechDocs over the weekend, and there's still no 9.1.2 or 9.2 line. There's no new VMSA today. SDDC Manager's Brotli fix is still pending, so the interim workaround remains your protection, and the ESX logging fix is worth finishing before the 11 November CISA deadline. On the Terraform side, the unreleased vsphere provider 2.18.0 picked up a second Supervisor change: namespaces can now be backed by distributed portgroups instead of a VPC. Eric Sloof has a useful read on which VCF 9.1.1 features are opt-in or tech preview, and today's deep dive looks at managing vDefend distributed firewall rules as code alongside VPC rules. 4 critical
- A quiet Sunday: VCSP Commit starts today, and SDDC Manager still waits for its Brotli fix It's a calm start to November. The one change you might feel today is on the provider side: from 1 November, new VMware Cloud Services Provider contracts are booked as VCSP Commit and managed in the Support Portal's Licensing module rather than the Consumption Portal, per KB 456620. Existing contracts stay where they are. There's no new VMSA today. SDDC Manager's Brotli flaw is still waiting on a patch, so the interim workaround remains your protection, and vCenter CVE-2026-59310 is still the patch to make sure you have. Otherwise TechDocs, the Terraform providers and the KBs we follow are unchanged. Azure VMware Solution's licence-included PayGo SKUs retired yesterday, and the deep dive looks at vSphere Lifecycle Manager images in VCF 9, including the composite images that let one cluster carry mixed hardware. 4 critical
October 2026
- Broadcom confirms SDDC Manager is its only product critically hit by the Brotli flaw Broadcom has published a portfolio-wide statement on the Node.js Brotli flaw. KB 460791 covers VCF and VVF 5.2.x and 9.x, Cloud Director, HCX, PowerCLI, Remote Console, Workstation and Fusion, and says none of them is critically affected except SDDC Manager in VCF 9.1.1. That narrows the job nicely, but there's still no SDDC Manager patch, so the interim workaround remains your protection. There's no new VMSA today; the SDDC Manager workaround comes first, and vCenter CVE-2026-59310 is still the patch to make sure you have. Otherwise it's a quiet Saturday: no new VCF patches and no new provider releases. Today is the last day for Azure VMware Solution's licence-included PayGo SKUs, and new VCSP contracts move to VCSP Commit tomorrow. Bob Plankers has a timely post on fencing off the management network, Virtually Speaking has a new episode on network observability, and the deep dive looks at memory tiering over NVMe in VCF 9.1. 4 critical
- Attackers are already going after the Brotli flaw behind Broadcom's SDDC Manager advisory The Node.js Brotli flaw that Broadcom's critical SDDC Manager advisory covers is now being attacked in the wild. Help Net Security, Security Affairs and SecurityOnline report that CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October, and researchers are logging exploit traffic against Node.js servers. Broadcom hasn't said SDDC Manager itself is being targeted and there's still no patch, so if you haven't applied the interim workaround and fenced SDDC Manager off to your admin networks, today is the day. There's no new VMSA today; the SDDC Manager workaround comes first, then checking your ESX hosts for July's logging fix. Everything else is calm: no new patches on TechDocs, no new provider or Packer releases, and the KBs we follow haven't moved. Google Cloud has launched a self-managed VCF 9 service on bare metal, we've corrected the direction of the breaking change coming in vsphere provider 2.18.0, and the Friday deep dive walks through building NSX Edge clusters from vCenter in VCF 9.1. 4 critical
- Reports say attackers used an ESX logging flaw to hide their tracks The story today is an old ESX bug with a new edge. CrowdStrike says the China-linked group it calls WARP PANDA used the low-scored ESX logging flaw that Broadcom fixed in July as a zero-day, so it could act on hosts without leaving a trail, and The Hacker News reports that CISA added it to its exploited-vulnerabilities catalogue on 28 October. If you patched for July's critical vCenter and ESX fixes on 9.x or 8.0 Update 3 you are already covered, but hosts on 8.0 Update 2 and VCF 5.x need a closer look. There's no new VMSA today; Broadcom has only revised the SDDC Manager Brotli advisory, which still has no patch. Everything else is quiet: no new patches on TechDocs, no new Terraform or Packer releases, and the KBs we follow haven't moved. If you use the Avi Terraform provider, there's a newly reported 32.1.4 regression worth knowing about, and the deep dive looks at getting ESX logs and audit records off the host, where an attacker can't quietly thin them out. 4 critical
- Broadcom has published a critical VCF advisory for the Node.js Brotli flaw The big story today is VMSA-2026-0008, a new critical advisory Broadcom published this morning for VMware Cloud Foundation. It covers the Node.js Brotli decoder flaw that has been making headlines all week, where a crafted compressed stream can lead to remote code execution. Press reports say SDDC Manager is the component affected and that patches are still pending, so for now this is about reading the advisory, applying its workarounds and keeping SDDC Manager reachable only from your admin networks. Beyond that new advisory, vCenter CVE-2026-59310 is still the one to have patched already. It's otherwise a quiet day: no new patches on TechDocs, no new provider releases, and the KBs we're tracking haven't moved. One thing for Terraform users to watch is a breaking change to the vsphere_namespace storage policies attribute, merged ahead of vsphere provider 2.18.0. Given the news, the deep dive looks at what SDDC Manager still does in VCF 9.1 and why it deserves a tight network boundary. 4 critical
- Broadcom confirms the eMudhra certificate compromise reaches VCF, with fixes to follow The story worth your attention today is a new Broadcom KB on the eMudhra certificate compromise. The private keys of eight eMudhra intermediate certificate authorities turned out to be guessable, and KB 460199 lists VCF and VVF 9.1.1 and 5.2.4 components, along with Cloud Director, HCX, Remote Console, PowerCLI, Telco Cloud Platform, Workstation and Fusion, as affected. Broadcom rates it high severity and says fixes will come in upcoming releases and documentation, so there's nothing to install yet. There's no new VMSA today, and vCenter CVE-2026-59310 is still the one to patch first. Elsewhere, the VCF blog explains the new Salt API for configuration and drift management of VCF components in 9.1.1, govmomi has a small 0.56.2 bugfix release, and Unexplored Territory is back with a vSAN roadmap episode. Builds, providers and the KBs we're tracking are unchanged. With certificates on everyone's mind, the deep dive walks through how certificate management works in VCF 9.1. 3 critical
- A vSAN File Services patch fixes SMB access lost after upgrading to 9.1 If you run vSAN File Services and came to 9.1 from anything older than 9.0, today's vSAN 9.1.1.0200 patch is for you. Released this morning, it fixes a problem where files and directories created before 9.0 can become unreachable over SMB after the upgrade, and that includes staged upgrades through 9.0.x. Broadcom has replaced the earlier 9.1.x File Services builds on the Support Portal with this one, so it's the build to use from now on. There's no new VMSA this morning, and vCenter CVE-2026-59310 is still the one to patch first. Elsewhere, VKS Add-ons v3.8.0+20261021 brings two new Helm-based add-ons, External Secrets Operator and Tekton, with an Istio two-step hop and a Telegraf check to plan for. The Register reports that Tesco is hiring someone to move its store edge estate from VMware to Proxmox, and VMware's VCF readiness tool has a 9.9.7 bugfix release. KBs and the Terraform providers are unchanged since last week. The deep dive looks at how binaries reach an air-gapped VCF 9.1 fleet: the three software depot modes and the VCF Download Tool. 3 critical
- VKS 3.8 has landed, bringing Kubernetes 1.37 and chained cluster upgrades If you run Supervisor clusters, the quiet news of the week is VKS 3.8.0, released on 22 October. It adds vSphere Kubernetes Release 1.37, lets workload clusters jump up to three minor versions in one chained upgrade, and brings audit logging, file integrity monitoring and an immutable Photon OS image. It also retires some older ClusterClasses and legacy add-on resources, so read the upgrade notes before you click anything. There's no new VMSA this weekend, and vCenter CVE-2026-59310 is still the one to patch first. There's also some good news hiding in the Supervisor release notes: Supervisor 9.1.1.0100, released on 12 October, already fixes the missing control plane VMs problem in KB 457944, even though the KB itself still calls the fix pending. Otherwise it's a calm Sunday: no new VCF patches since 12 October, no new Broadcom KBs worth flagging, and nothing new from the Terraform providers, though govmomi has a small 0.56.1 update. The deep dive looks at how password management really works in VCF 9.1, and why the SDDC Manager service-account lock in KB 459311 is a good reminder to let the platform own its own credentials. 3 critical
- Broadcom says vDefend and Avi aren't hit by PHP2Shell, and shows how to shield PHP VMs Broadcom has widened its PHP2Shell all-clear. KB 460110 says vDefend isn't affected and points to IDS/IPS signatures that can virtually patch your PHP workloads, and KB 460068 does the same for Avi with a set of WAF rules. Neither replaces the PHP patch, but both buy useful time for VMs you can't update straight away. There's no new VMSA this weekend, and vCenter CVE-2026-59310 is still the one to patch first. Otherwise it's quiet: no new VCF patches since 12 October and nothing new from the Terraform providers. Two NSX 9.1.1 KBs are worth reading before your next maintenance window, Virtually Speaking has a new episode on planning a VCF upgrade, and the deep dive looks at choosing and protecting key providers for encryption in VCF. 3 critical
- Attackers are getting from a Palo Alto VPN flaw into vCenter and switching off ESXi protections The story to read first today isn't a VMware bug, but it lands squarely on your platform. Palo Alto's Unit 42 says attackers exploiting the GlobalProtect flaw CVE-2026-0257 moved from the VPN gateway to the vCenter appliance, disabled execInstalledOnly on ESXi hosts, and dumped credentials straight from a domain controller's virtual disk, bypassing in-guest EDR. If your VPN and vCenter sit close together, it's a good day to check that path. On VMware advisories there's nothing new from Broadcom, but our count was short. Broadcom's advisory pages also show VMSA-2026-0004 (VCF Operations), VMSA-2026-0002 (Workstation and Fusion) and VMSA-2025-0004 (ESXi, with exploitation in the wild stated by Broadcom) as Open, so eight are listed below. vCenter CVE-2026-59310 from VMSA-2026-0006 is still the one to patch first. Elsewhere, Broadcom has introduced KubeVM Service for declarative, Kubernetes-style VM management, renewed its infrastructure software agreement with FedEx, and William Lam's VCF upgrade planner can now plan Supervisor and VKS upgrades. The deep dive looks at backing up and restoring the Supervisor control plane in VCF 9.1, which is also the recovery route for KB 457944. 6 critical
- Broadcom says VCF isn't exposed to PHP2Shell, but check everything else that runs PHP The biggest story today is PHP2Shell. The PHP project disclosed two critical flaws, CVE-2026-109618 and CVE-2026-109619, on 21 October, and Broadcom has answered the question every VCF admin is asking in KB 459989: "VMware Cloud Foundation components do not use PHP and are not affected." That's good news for vCenter, SDDC Manager, NSX and the rest of the stack, but it doesn't cover the PHP applications, jump boxes and tooling running on your VMs, and exploitation attempts are already being reported. On VMware advisories, there's nothing new from Broadcom, but vCenter CVE-2026-59310 from VMSA-2026-0006 remains in CISA's Known Exploited Vulnerabilities catalogue with known ransomware use, so an unpatched vCenter is still the first job of the day. We've also added VMSA-2026-0005, a critical Avi Load Balancer advisory from 14 July that is still open and was missing from earlier briefings. Elsewhere, Avi Load Balancer 32.1.4 tightens several defaults that could break DataScripts and API clients on upgrade, the SDDC Manager 9.1.1.0200 notes list a Binary Management quirk with large depots, and today's deep dive looks at what vSAN ESA storage policies really do in 9.1. 5 critical
- No new patches today, but Broadcom's six-part VPC connectivity series is worth your time It's a quiet morning for patches, which makes it a good day to read Broadcom's new six-part series on tenant connectivity in VCF 9.1. If you run NSX VPCs, and especially if you've ever wondered why a VPC workload leaves with one source address on one path and a different one on another, Part 2 sets out the four rules that decide it, and today's deep dive builds on it. Security hasn't changed, and it still needs your attention. There's no new advisory from Broadcom, but vCenter CVE-2026-59310 from VMSA-2026-0006 remains in CISA's Known Exploited Vulnerabilities catalogue with known ransomware use, so any unpatched vCenter is still the top job. Elsewhere, three Broadcom KBs are worth a read before your next 9.1.1 upgrade, VCF Operations 9.1.1 has a new capacity forecasting engine that may nudge your rightsizing numbers, and there's a small correction on the Azure VMware Solution deadline: 31 October applies to licence-included PayGo SKUs, not every licence-included node. 4 critical
- Broadcom has put a firm date on the end of vSphere 8, NSX 4 and VCF 5.2: 11 October 2027 If you're still planning your move from VCF 5 to VCF 9, you now have a fixed date to plan around: Broadcom's KB 456708 sets 11 October 2027 as the end of service for ESXi and vCenter 8.x, vSAN 8.x, NSX 4.x, VCF 5.2.x, Aria 8.18.x and HCX 4.x. Security is unchanged today but still needs your attention, because vCenter CVE-2026-59310 from VMSA-2026-0006 is in CISA's Known Exploited Vulnerabilities catalogue with known ransomware use. Elsewhere, Broadcom signed a 10-year VCF deal with NTT DOCOMO, and today's deep dive walks through how express patches work in VCF 9.1. 4 critical
- vCenter CVE-2026-59310 is in CISA KEV; new VCF Operations 9.1.1 certificate KB A quiet weekend for releases, but not for security: vCenter CVE-2026-59310 from VMSA-2026-0006 has been in CISA's Known Exploited Vulnerabilities catalogue since 18 August, and CISA lists known ransomware campaign use. New in the knowledge base: VCF Operations 9.1.1 can raise recurring internal-certificate alerts after upgrade (KB 456305). Today's deep dive covers the VCF 9.1 license server. 4 critical