# VMware / Broadcom 日跟踪 · 2026-10-07
> 日期：2026-10-07（Asia/Shanghai，周三）。原料：archive/2026-10-07/vmware/。窗口：10-06（周二）早报之后 → 10-07（周三）早。上一日成功日跟踪 2026-10-06。抓取全库：Saved 275 / skipped 27 / errors 39；blocked：blocksandfiles.com / e.huawei.com / support.huawei.com / www.nextplatform.com / www.reddit.com / www.theregister.com（docs.redhat.com 本日未进 blocked，但 OpenShift Virtualization 4.19 文档页 HTTP 503）。全库相对既往归档新增 URL 7 个（vmware 3、redhat 2、industry 2）。

## 摘要
- **新稿 · VCF Security Hardening Guidance**（VCF 博客，URL 日期 10-05；网络安全月「Day 3 of 22」；10-06 抓取未见，本日首次入库）：介绍 **Security Configuration Guide（SCG）**——Excel + CSV 发布在 GitHub `vmware/vcf-security-and-compliance-guidelines`（"accessible … to machines, now that AI agents are part of the landscape"）；字段含 SCG ID、Secure Controls Framework ID、**DISA STIG ID**、**PCI DSS 4.0.1 / NIST SP 800-53R5** 映射、潜在功能影响、**P0/P1/P2/Advanced** 优先级、PowerCLI 评估/修复样例脚本。FAQ 要点：SCG vs **CIS Benchmarks**（"they cover only ESX"）、vs DISA STIG；**VCF 9.1 管理面 VCF Management Services（VCFMS）为 "Kubernetes-powered platform"，无用户可配置项故 SCG 无控制项**；Photon OS 设备预加固；"实施 SCG 本身不等于合规"——**厂商最佳实践/文档推广，非新产品**。
- **新稿 · What’s New in VCF 9.1.1 for Single Sign-On**（10-06）：VCF Operations（VCF 9.1.1）新增 **AD / OpenLDAP「On-Demand Lookup」**——登录时实时查询目录、按当前组成员授权，免预置用户/组与定时同步；可与预置模式混合、多目录。IdP 列表含 **Symantec Identity Security for VCF（9.1 起）**、Okta、AD FS、Entra ID、Ping、通用 OIDC/SAML 2.0；JIT/SCIM 预配；9.1 起 VCF 专属/自定义角色、API client/token——**厂商博客；本地无 9.1.1 发布说明，版本发布日期不另写**。
- **新稿 · Dependencies Are a Boat Anchor**（10-06，观点博）：补丁滞后常因等 OEM 厂商 ISO（"some release as rarely as quarterly. Waiting 90 days … is simply not acceptable"）与存储阵列管理插件；强调 ESXi 更新可累积打在 vendor ISO 安装之上、vLCM OEM Add-On 叠加、本地盘多走 inbox NVMe 驱动；建议用 REST+Prometheus / syslog 取代私有插件，并以 **NSX / vSAN / VCF Automation 取代第三方依赖**（"the delay for vCenter support of vSAN is precisely 0 days every time"）——**厂商观点 + 自家栈替代第三方的捆绑话术**；与 10-02 Express Patching / Live Patch 同线。
- 轻：AI Part 3 文末补 Performance Engineering 联系邮箱；Security Starts with Hardware（Day 2）删去「全月排期见下」措辞——**无实质增量**。
- 续档：Forrester 委托 Spotlight（90%/70%/33%/50%）；AI Part 3 共置自测；SmartNIC IPsec 卸载（9.1）；双 MQ Leaders PR；VR 09-23 MQ 媒体转述、**本地无 Gartner PDF**。10-08 首场安全月 webinar 仍为排期。

## 原文摘录

### [VCF Security Hardening Guidance](https://blogs.vmware.com/cloud-foundation/2026/10/05/vcf-security-configuration-guide/) · 新稿（安全月 Day 3）
- 归档：`vmware/vcf-security-hardening-guidance-e8a65fc5.txt`
> We deliver the SCG as a Microsoft Excel spreadsheet and a CSV, making it easily accessible to everyone, as well as to machines, now that AI agents are part of the landscape.
> Implementation Priority: P0 is where there is not a secure default, and you should do this immediately. P1 has an acceptable default, but might not be as good as it could be … P2 controls have a secure default, but you should continue to audit them.
> People often ask about CIS Benchmarks in particular. A separate organization develops them, they cover only ESX, and they follow their own release schedule.
> VCF 9.1 introduces a new architecture for management appliances, via the VCF Management Services (VCFMS) platform. This is a Kubernetes-powered platform inside VCF itself that runs the VCF management functions. There are no user-configurable settings inside VCFMS, so there are no controls for it in the SCG.
> Q11: If I implement the SCG, am I compliant with PCI DSS, NIST SP 800-53, or another standard? A11: Not by itself.

### [What’s New in VMware Cloud Foundation 9.1.1 for Single Sign-On](https://blogs.vmware.com/cloud-foundation/2026/10/06/whats-new-in-vmware-cloud-foundation-9-1-1-for-single-sign-on/) · 新稿（功能博客）
- 归档：`vmware/what-s-new-in-vmware-cloud-foundation-9-1-1-for-single-sign-on-215e0603.txt`
> VCF Operations in VCF 9.1.1 introduces an option for administrators to enable On-Demand Lookup for Active Directory and OpenLDAP accounts.
> When enabled, the Identity Broker queries the users directly from the directory for authentication. On-demand Lookup doesn’t require user and groups to be pre-provisioned – authorization is based upon a user’s current group membership in the directory at the time of login.
> Identity providers include Symantec Identity Security for VCF (IDSP)*, Okta, Microsoft Active Directory Federation Services (AD FS), Microsoft Entra ID, Ping, or any (generic) OIDC or SAML 2.0 provider.

### [Dependencies Are a Boat Anchor](https://blogs.vmware.com/cloud-foundation/2026/10/06/dependencies-are-a-boat-anchor/) · 新稿（观点博）
- 归档：`vmware/dependencies-are-a-boat-anchor-8cbe0d99.txt`
> A common cause for patching gaps is that customers state they are waiting on a 3rd party server vendor to package the ESXi release into an ISO file.
> The challenge is that vendors do not keep up with hotpatches, and some release as rarely as quarterly. Waiting 90 days for bugfixes and critical security patches is simply not acceptable.
> In reality, all updates to ESXi are cumulative, and you can apply the latest patches to an install that began with a vendor ISO.
> VMware NSX manages overlays and can replace complicated appliance-based solutions, VMware vSAN for storage can replace the need for storage provisioning plugins, and VCF Automation means you don’t need to wait on a CMP to approve a patch.
> At no point in the last 10 years has vSAN been allowed to ship a new version that was incompatible with vSphere (or vice versa), and the delay for vCenter support of vSAN is precisely 0 days every time.

## 对基础档案的影响
- **最近动态追加**：SCG 加固指南（含 VCFMS=K8s 管理面无可配项、CIS 仅覆盖 ESX 的对比话术）、VCF 9.1.1 SSO On-Demand Lookup、「依赖是锚」补丁观点博（自家栈替代第三方插件话术）。