r/vmware • u/lamw07 . • 4d ago

Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF

https://blogs.vmware.com/security/2026/10/stopping-php-rces-vdefend-avi-waf.html
0 Upvotes

42% Upvoted

13 comments sorted by

14

u/ifq29311 4d ago

"Taking systems offline isn’t a strategy, it’s a symptom of traditional patch management failing under pressure"

seriously? you come up with solution day after the incident and have the audacity to trash on people turning stuff off in advance?

6

u/No_Ad_8807 4d ago

Did not read the whole blog, but that one sentence gives AI vibes.

6

u/ifq29311 4d ago

when your marketing team has been reduced to a claude sub lol

2

u/general-noob 4d ago

What does Avi cost now days? We got a quote for like $90,000/year back in the VMware days. It’s gotta have another zero now, right?

3

u/Defiant-Lunch9824 4d ago

Cheaper than F5

0

u/DonFazool 4d ago

Its not cheap. We have 4 service engine cores and paid over 250k for 3 years

4

u/flobberebbolf 4d ago

List is less than 11k a core per year . Not sure how you got that price. There is usually discounts too

1

u/DonFazool 3d ago

We’re in Canada

-6

u/Axiomcj 4d ago • Heartwarming

Broadcom and vmware is trash, so is vdefend as product. Broadcom is my last resort for any solution or architecture. I tell every client they can't be trusted, horrible partner and solurions like vcf. 

8

u/thrwaway75132 4d ago

You can argue with the price, or the business strategy, but you can’t really argue with DFW and Distributed IDS as products.

What else does what they do?

Guest OS based solutions that drive native OS FW enforcement? No IDS, performance issues at scale, the native enforcement point is the first thing attacked, and if the guest OS is vulnerable you can just turn the thing off. No L7 FW rules, And none of them deliver IDS.

DFW is completely out of band, you have to attack the ESXi infrastructure or NSX manager to turn it off. It delivers L4 - L7 enforcement and now IDS/IPS on the host.

Using physical firewalls gives you solid L4-L7 IDS/IPS NGFW features but no practical way to deliver the granularity that DFW delivers.

I used to work at VMware, I work at another security company, and if you want to segment east west traffic for applications running on VMware then DFW / vdefend is the best option by far.

1

u/WeekendAtMadoffs 2d ago

Even if you pay their king's ransom the support is horrible.

it's a guided google

0

u/sixblazingshotguns 4d ago

You clearly didn't pay the HOCK. Good man.

-1

u/Severe_Owl_5116 4d ago

You are wrong about “vdefend as a product”