VMware launched general availability of Cloud Foundation (VCF) 9.1.1, a security heavy update that is part of a reconfigured VCF update cadence.
The update itself includes a push around security, vSAN Object Storage, and new features to better support private cloud management, however, it’s that first component and its link to Anthropic’s Claude Mythos AI vulnerability searcher and corresponding Project Glasswing that is garnering the most interest.
Krish Prasad, SVP and GM for VCF at Broadcom, explained to an audience at the recent VMware Explore event that VCF 9.1.1 is an amalgamation of recent patches it has found since implementing Glasswing.
“We have delivered two or three monthly batches already, and our next maintenance release, which groups all the patches together, is coming, which is 9.1.1,” Prasad told that audience.
“When Mythos first came up customers were all like, ‘hey the priority is secure the environment,’ and so we made a commitment to customers that we are going to prioritize that and what that meant is some of the feature, things that we are working on, we are going to delay and put this as the priority. So that's essentially what is happening,” Prasad said in a separate interview with SDxCentral at the event. “If you think about our roadmap, we are prioritizing security first.”
Prasad added that “customers were happy” with this update change “because they are worried about security too, and they're like, ‘hey, it's great to see that you're taking it seriously. You're doing it as rapidly as you can.’ So yeah, we have gotten tremendous support from the customers.”
Customers at the event did express support for the move, despite the release altering VMware’s previous realignment on its VCF update strategy. That alteration was announced last year and moved from having a “major” release every two years with “minor” updates every six months to a new model of releasing those major updates every three years with minor updates every nine months.
VCF 9.0, which was a major release, was unveiled in June 2025. VCF 9.1, which was a minor update, followed 11 months later, with the 9.1.1 update coming four months later. Prasad’s presentation showed a more nebulous dotted date line following the 9.1.1 release, with a description of “no disruptive changes (architectural, APIs) to accelerate adoption; delay VCF 9.2 feature release.”
Customers comfortable with some change #
Some VCF customers at the event did note the lumpiness of the release cycle but understood the need for quick action following the release of Mythos.
“Anytime you change the release cycle, there is some discomfort, but I would say that why they changed the release cycle is more important to me,” Ed Kerr, head of product for software and services at Rackspace, told SDxCentral. “They used Mythos to uncover vulnerabilities, and 9.1.1 … is a result of a bunch of vulnerabilities that we need to patch then honestly we're happy to do it regardless of the life cycle.”
Kerr added that the key for any change remains communication.
“I think that's probably the big thing for us is understanding when we partner with them ahead of time, what's driving this release? Do we even need to adopt it? Can we just stay on 9.1?” Kerr said. “Now, in the case of 9.1.1, we do think that there's a lot of things that we should be adopting there, and so we will be. But in the future, 9.1.2 might not be something that we rush to.”