# 安全 · 日跟踪 · 2026-10-07

> 日期：2026-10-07（Asia/Shanghai，周三）。专题正文：`intel/topics/security.md`。原料：`/workspace/intel/archive/2026-10-07/`（窗口 10-06 早报后→10-07 早）；对照 2026-10-06 日跟踪。抓取：Saved 275 / skipped 27 / errors 39；blocked_hosts：blocksandfiles.com、e.huawei.com、support.huawei.com、www.nextplatform.com、www.reddit.com、www.theregister.com（docs.redhat.com 本日未进 blocked；Virt 4.19 文档页 HTTP 503）。全库新增 URL 7 个。

## 摘要
- **NEW（厂商最佳实践）· VMware VCF Security Hardening Guidance（安全月 Day 3）**：SCG（Excel+CSV，GitHub）映射 Secure Controls Framework / **DISA STIG / PCI DSS 4.0.1 / NIST SP 800-53R5**；P0（无安全默认、立即做）/P1/P2/Advanced；PowerCLI 评估与修复样例；FAQ：CIS 仅覆盖 ESX、STIG 面向美政府；**VCF 9.1 VCFMS（K8s 管理面）无用户可配项**；Photon OS 预加固；"实施 SCG 本身不等于合规"。
- **NEW · VCF 9.1.1 SSO On-Demand Lookup**：AD/OpenLDAP 登录时实时查组授权，便于承包商/审计临时权限随组成员变化生效；IdP 含 Symantec Identity Security for VCF（9.1 起）等——**厂商博客**。
- 中（观点）· 「Dependencies Are a Boat Anchor」：补丁滞后是安全问题（详见 reliability）。
- 媒体快讯（轻）：LASST 起诉 OpenAI，要求禁止 AI 代理未经许可访问第三方系统（至顶网摘要）。
- 续档：安全月 10-08 首场 webinar（排期）；Google OSS VRP 冻结；XCP-ng OpenSSL 3.5.5。

## 原文摘录

### VMware · VCF Security Hardening Guidance（厂商博客，安全月 Day 3）
- 归档：`vmware/vcf-security-hardening-guidance-e8a65fc5.txt`
- URL：https://blogs.vmware.com/cloud-foundation/2026/10/05/vcf-security-configuration-guide/

> These guides, started almost two decades ago, form the basis of security configuration in and around the products themselves. Nowadays you can find the guides out in our GitHub repository: https://github.com/vmware/vcf-security-and-compliance-guidelines  
> People often ask about CIS Benchmarks in particular. A separate organization develops them, they cover only ESX, and they follow their own release schedule.  
> Q11: If I implement the SCG, am I compliant with PCI DSS, NIST SP 800-53, or another standard? A11: Not by itself.

### VMware · What’s New in VCF 9.1.1 for Single Sign-On（厂商博客）
- 归档：`vmware/what-s-new-in-vmware-cloud-foundation-9-1-1-for-single-sign-on-215e0603.txt`
- URL：https://blogs.vmware.com/cloud-foundation/2026/10/06/whats-new-in-vmware-cloud-foundation-9-1-1-for-single-sign-on/

> On-demand Lookup doesn’t require user and groups to be pre-provisioned – authorization is based upon a user’s current group membership in the directory at the time of login.