VMware is pushing so many patches, it thinks users need new tools to manage the flood

VMware has identified numerous vulnerabilities in its products through AI, leading the company to develop a new product to help users manage the overwhelming number of patches. Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation (VCF) division of Broadcom, explained to The Register that VMware recently shifted to delivering monthly software updates, partly to address AI-discovered bugs.

However, Shenoy admitted that customers found it challenging to keep up with the rapid pace of change, as testing the impact of patches takes time, even though VCF allows non-disruptive live patching. To assist users, VMware introduced HyperArmor, a tool with three key functions. First, it offers virtual patching, blocking attempts to exploit vulnerabilities without altering the vulnerable software.

VMware demonstrated this by referring to CVE-2024-5806, a bug in MOVEIt file transfer tool that caused a stir in 2024. HyperArmor will similarly block malicious traffic targeting VCF implementations. Second, HyperArmor rejects actions that alter known good states in VCF, updating policies to allow the altered state if a human approves a change.

Finally, the tool implements multi-factor authentication (MFA) to protect against attackers using stolen privileged credentials to access VMware's ESX hypervisor. Shenoy confirmed that VMware designed HyperArmor to safeguard against attackers gaining control of hosts via stolen credentials and requiring users to input SSH credentials and a secondary time-based one-time password for added security.

While VMware will sell HyperArmor as an add-on to VCF, the company did not create the product; Broadcom's security businesses Symantec and Carbon Black developed it. Broadcom's Infrastructure Software Group, which operates with multiple teams, launched AgentMinder to prevent rogue AI within VCF. At VMware Explore, Ram Velaga, president of Broadcom's Infrastructure Software Group, explained the company's strategy of combining individual team focus with overall group collaboration.