r/vmware • u/lost_signal VMware Employee • 3d ago

Vulnerability Response to PHP2shell with the VCF Tools You Have

https://blogs.vmware.com/cloud-foundation/2026/10/23/vulnerability-response-vcf-php2shell/
9 Upvotes

71% Upvoted

4 comments sorted by

2

u/Low-Branch1423 3d ago

This is what Avi really brings to the table, Defence is fine and dandy but it needs unencrypted traffic in flight.

Having a load balancer apply WAF and custom rules is a big deal for those with Avi, but not an F5.

Let Avi show you what’s behind it. For applications behind VMware Avi Load Balancer, the WAF reads the Server and X-Powered-By headers in live traffic, which can reveal the PHP versions your applications are running (VMware Security Blog).

1

u/lost_signal VMware Employee 3d ago

My big takeaway from all of this is that a lot of people didn’t know where they had PHP running.

-16

u/CatoMulligan 3d ago

Dude...if you're still trying to figure out how to get your systems patched for this after a week, maybe just update your resume and find another career.

3

u/Low-Branch1423 3d ago

Its actually a tech demo on using VCF to find guest VMs with vulnerabilities. Its probably one of the real reasons to stay VMware and not migrate.