LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
VULNERABILITY ANALYSIS // MEDDEVICE CYBER
Vulnerability

STERIS issues third-party PHP advisory SAN-2026-00001

STERIS published advisory SAN-2026-00001, Third Party Vulnerability: PHP, on October 30, 2026, its first product security advisory listed for 2026.

MedDevice Cyber Staff  ·  1 day ago  ·  2 min read  ·  Via STERIS
02
Intelligence
Patient sues University Hospitals over October cyberattack that took MyChart offline

University Hospitals detected unusual server activity on October 22 and disconnected its systems, taking down the MyChart portal and other digital services at the Cleveland health system. Six days later a patient filed a proposed class action claiming the health system failed to secure patient data that could include Social Security numbers and treatment records for more than a million people, a number University Hospitals has not confirmed.

3 days ago  ·  3 min read  ·  Via
Sponsored

AI-Native Medical Device Pentesting and Vulnerability Management.
03
Boston Scientific puts the August cyberattack at $150 million of lost third quarter sales
INCIDENT UPDATE  ·  3 days ago
04
University of New Mexico Health cyberattack forces ambulance diversions
INTELLIGENCE  ·  5 days ago
05
Philips lists PIC iX 4.x in its Node2Shell advisory and makes customers responsible for mitigations
VULNERABILITY  ·  5 days ago
Browse by Threat
CISA KEV · MITRE EMB3D · ATT&CK · CWE

Latest Intelligence

Updated 1 day ago
Vulnerability
Siemens Healthineers acknowledges critical PHP flaws CVE-2026-109618 and CVE-2026-109619

Siemens Healthineers posted an October 26, 2026 customer notification on the critical PHP flaws CVE-2026-109618 and CVE-2026-109619, with product details only on teamplay Fleet and myvarian.

Siemens Healthineers5 days ago2 min read
Vulnerability
Leica Biosystems posts PHP2Shell notice for PHP versions before 8.5.11

Leica Biosystems said on October 23, 2026 it had been notified of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP prior to 8.5.11.

Leica BiosystemsOct 232 min read
Vulnerability
Vision RT says AlignRT and its clinical systems are not affected by PHP2Shell

Vision RT said on October 23, 2026 that its clinical systems, including AlignRT, are not affected by PHP2Shell, CVE-2026-109618 and CVE-2026-109619.

Vision RTOct 232 min read
Vulnerability
Four unpatched flaws disclosed in HAPI FHIR, the server library behind Smile CDR

A researcher found four flaws in HAPI FHIR, the open-source Java library that underpins Smile Digital Health's Smile CDR and at least eight other commercial platforms. The worst, CVE-2026-113874 at 8.1 on CVSS v3.1, lets an authenticated user override the partition header on a Bundle entry and read or write another tenant's clinical data. None of the four has a confirmed fix yet.

oss-security mailing listOct 223 min read
Intelligence
Quest Diagnostics discloses breach of its Quanum lab ordering system

Quest Diagnostics paused access to Quanum Lab Services Manager on October 21 after finding unauthorized access, then disclosed the incident in an SEC filing the next day without a scope figure. The company says patient records were accessed; it has not said how many.

SECOct 223 min read
Vulnerability
InterSystems IRIS for Health ships with encryption off by default

CVE-2026-111594 lets anyone on the same network segment read InterSystems IRIS for Health traffic in cleartext and reuse what they capture to log in. There is no patched release, only a configuration fix.

CISAOct 223 min read
Regulatory Watch
01
AdvaMed to Build Industry Cybersecurity Standards After a Year of Device Maker Attacks
MedTech Dive · Oct 19
 02
HSCC publishes a playbook assigning who can touch a clinical AI tool after it fails
Industrial Cyber · Oct 8
 03
Senate passes S. 3315, mandating MFA and encryption for every HIPAA covered entity
Congress.gov · Sep 30
 04
Labcorp to pay $2.3 million and submit to vendor security audits for five years
New York Attorney General · Sep 24
Vendor & Market
Sponsored

AI-Native Medical Device Pentesting and Vulnerability Management.
From the directory

Armis  ·  Asimily  ·  Blue Goat Cyber  ·  Claroty (Team82)  ·  Cybellum  ·  Finite State  ·  MedCrypt  ·  MedSec  ·  Ordr  ·  Promenade Software  ·  Sequoia (GDT)

Browse the vendor directory →