A few days ago, I wrote about my use of virtual machines and I mentioned this:
Now, earlier on I did mention that I currently run two virtual machine software. That’s going to change as I am going to migrate to UTM for all my virtual machines. I’m doing that because since VMware has been acquired by Broadcom, their level of support has nosedived. You can take a scroll through the VMware Sub-Reddit to see the complaints about this acquisition that people have. And a lot of my clients are looking to move their enterprise level virtual machines off of the VMware platform for greener pastures like Microsoft Hyper-V, Nutanix or Citrix as a result of the chaos caused by the Broadcom acquisition. That lessens my need to run VMware’s software. Also UTM has much broader support for classic operating systems such as Windows XP and Windows 7. Which is something that VMware doesn’t offer. Thus it makes sense for me to transition to UTM.
Well I may be rethinking this move because The Register is reporting that VMware or more accurately Broadcom who owns VMware now is going to offer Workstation Pro for PC and Fusion Pro for Mac are now going to be offered for free… For personal use. Now part of me thinks that this is a trap as this is an honour system. Meaning that if you’re some kid in their college dorm, Broadcom won’t care. But some company will likely play fast and loose with this and I can see Broadcom doing an audit and catching out a company on this front. I’m thinking this because the acquisition of VMware by Broadcom has been a clown show.
Anyway, the transition from the VMware customer portal to the Broadcom version is something that’s currently ongoing and is scheduled to end today. Assuming that happens on schedule, which given that this whole acquisition has been a clown show as mentioned previously I question if that is going be the case, I’ll be able to get a license key and test out Fusion Pro. Then I will be able to make a call as to if I should move to UTM. Right now I can’t see any of my VMware license keys in the customer portal, and I can’t make new ones to get Fusion Pro working. But let’s see if that changes.
UPDATE: Here’s the official announcement from VMware/Broadcom
UPDATE #2: I just got a chance to try updating to version 13.5.2 of VMware Fusion. It didn’t work and I am still stuck on VMware Fusion Player. I did some checking around and I found this post from the Product Manager of VMware Fusion Michael Roy who states that he is coming up with details on how to convert to Fusion Pro if you have Fusion Player installed. But the linked post walks you through how to install Fusion Pro as a new user.
UPDATE #3: I now have the Pro version of VMware Fusion installed. What I did is use a utility called AppCleaner to get rid of the current install of VMware Fusion Player. Then I downloaded version 13.5.2 from the Broadcom site and installed it. When you do that, you get the option to use the Pro version for personal use after the install is finished. This is pretty dumb as I should not have to delete the app to get this to work. It should simply work via an upgrade to 13.5.2. Clearly VMware or likely Broadcom didn’t have this scenario in their test plans. In any case, you won’t lose any of your virtual machines by doing this. Though you will have to go to File –> Scan For Virtual Machines to add them back.
VMware Related Zero Day Has Been Exploited By Threat Actors For A Year…. Wow!
Posted in Commentary with tags VMWare on October 1, 2025 by itnerdBroadcom has patched a high-severity VMware vulnerability (CVE-2025-41244, CVSS 7.8) that had been exploited as a zero-day for nearly a year. The flaw, impacting VMware Aria Operations and VMware Tools (including open-vm-tools on Linux), allows privilege escalation to root on VMs. Security researchers at NVISO Labs reported that a Chinese state-sponsored threat group, UNC5174, has been actively exploiting the bug, including by staging malicious binaries in writable directories like /tmp/httpd. Patches are now available across VMware Cloud Foundation, vSphere, Aria Operations, Telco Cloud Platform, VMware Tools, and open-vm-tools (to be distributed by Linux vendors). Detection requires monitoring for uncommon child processes or leftover collector scripts.
You can find more details here: https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/
Gunter Ollmann, CTO, Cobalt had this comment:
“Zero-days that persist in widely used infrastructure for nearly a year highlight the growing mismatch between vendor disclosures and adversary realities. In this case, the triviality of the exploit means it likely fell into the hands of multiple threat actors, not just those with nation-state capabilities. When exploitation is both simple and widespread, leaving customers unaware is an unforced error that adds unnecessary risk. The industry needs more candor around zero-day exploitation so defenders can calibrate their urgency. In the long run, trust in security advisories will matter as much as the patches themselves.”
Dale Hoak, CISO, RegScale adds this:
“An unpatched or undisclosed zero-day undermines the very foundation of compliance programs, which rely on accurate risk data. If customers don’t know an exploit is active, they can’t prioritize remediation, leaving regulators and auditors working from a false baseline of assurance. This is why it’s critical to operationalize risk in the larger context of patching—moving beyond a checklist exercise to a process that connects advisories, vulnerability data, and remediation actions in real time. Continuous controls monitoring enables that connection, ensuring that controls are validated against live threats, not just documented in static reports. Real assurance comes when organizations can align compliance, risk, and patching as a single operational discipline.”
While I am a big believer in patching all the things, you also have to have an approach to security that mitigates the potential effects of zero days. That’s not easy to do, but it has become a requirement given how quickly threat actors evolve and shift tactics.
I should also mention that the fact that this was out there for a year is bad. Extraordinarily bad. But you knew that already.
UPDATE: Adrian Culley, Senior Sales Engineer at SafeBreach adds this comment:
“Broadcom has released fixes for CVE-2025-41244 and related issues affecting VMware Aria Operations and VMware Tools. In certain configurations, VMs with VMware Tools managed by Aria Operations with SDMP enabled local privilege escalation to root. NVISO reports the bug was exploited in the wild since mid-October 2024 by a China-nexus actor assessed as UNC5174. Teams should patch Aria Operations/Tools immediately and ensure Linux hosts receive updated open-vm-tools from their distributors. Hunt for exploitation by looking for mimicked system binaries (e.g., httpd) in writable paths like /tmp/httpd and for unusual child processes from discovery collectors. After patching, continuously validate that privilege-escalation, credential harvesting, and lateral-movement paths are closed—don’t just assume they are.”
Leave a comment »