LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Elekta // Products

MOSAIQ Oncology Information System

Accelerator, Linear, Medical. Attributes come from Elekta's own public documentation for this product.

Attributes

Signals
Patient or study database File import Role-based access Handles patient data HL7 or FHIR integration DICOM or image parsing Hospital network
Properties (MITRE EMB3D)
PID-2322 Device deploys an access enforcement/privilege mechanism PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces PID-34 Device stores logs of application events and information PID-41 Device exposes remote network services
Attributes: component types
Display Generic Application Local Application Local Service Operating System User Interface
Attributes: interface types
TCP TLS
Attributes: assets
Log Data Report Data

Matched threat intel

16

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Elekta has said.

AdvisoryDateSharedElekta status
Path traversal in Thermo Fisher's Torrent Suite lets authenticated users read server filesOct 15, 2026Same property (MITRE EMB3D)PID-34No feedback feed from manufacturer
A low-privilege user can walk past role limits in Synapse MobilityAug 21, 2025Same property (MITRE EMB3D)PID-2322No feedback feed from manufacturer
A legacy cardiology system, end-of-service since 2014, recalled for securityJun 10, 2025Same property (MITRE EMB3D)PID-23No feedback feed from manufacturer
Thermo Fisher Xcalibur and Foundation driver packages allow local privilege escalationJan 22, 2025Same property (MITRE EMB3D)PID-23No feedback feed from manufacturer
Philips DreamMapper 2.24 and earlier write attacker-useful details to log filesJul 30, 2020Same property (MITRE EMB3D)PID-34No feedback feed from manufacturer
Philips IntelliBridge Enterprise writes plaintext EMR credentials into its transaction logsJun 11, 2020Same property (MITRE EMB3D)PID-34No feedback feed from manufacturer
User enumeration on the CareLink Network, found at a conferenceDec 4, 2025Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
A hospital management backend leaked its own system informationOct 28, 2025Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
Dario Health glucose monitoring app and servers exposed cross-user health dataFeb 27, 2025Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
Softneta MedDream PACS allows unauthenticated remote code executionSep 5, 2023Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
BD Synapsys sessions did not expire, risking changes to patient dataMay 31, 2022Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
LifePoint Informatics Patient Portal generated lab report PDFs from a URL and a patient IDApr 5, 2022Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
Philips Gemini PET/CT systems write sensitive data to removable media without access controlMar 25, 2021Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
OpenClinic GA advisory lists authentication bypass, file upload and SQL abuse flawsJul 2, 2020Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
Roche Accu-Chek and CoaguChek point of care handhelds expose a weakly protected service interfaceNov 6, 2018Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer
Change Healthcare PeerVue Web Server leaks technical details in HTTP error messagesOct 4, 2018Exposed to the same EMB3D threatTID-226No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-204 Untrusted Programs Can Access Privileged OS Functions TID-205 Existing OS Tools Maliciously Used for Device Manipulation TID-210 Device Vulnerabilities Unpatchable TID-213 Faulty FW/SW Update Integrity Verification TID-219 OS/Kernel Privilege Escalation TID-221 Authentication Bypass By Message Replay TID-222 Critical System Service May Be Disabled TID-226 Device leaks security information in logs TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-317 Predictable Cryptographic Key TID-319 Cross Site Scripting (XSS) TID-323 Path Traversal TID-324 HTTP Direct Object Reference TID-329 Improper Password Storage TID-401 Undocumented Protocol Features TID-406 Unauthorized Messages or Connections TID-408 Unencrypted Sensitive Data Communication
CWE weaknesses
CWE-1104 Use of Unmaintained Third Party Components CWE-1188 Insecure Default Initialization of Resource CWE-1329 Reliance on Component That is Not Updateable CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-276 Incorrect Default Permissions CWE-284 Improper Access Control CWE-294 Authentication Bypass by Capture-replay CWE-321 Use of Hard-coded Cryptographic Key CWE-427 Uncontrolled Search Path Element CWE-522 Insufficiently Protected Credentials CWE-639 Authorization Bypass Through User-Controlled Key CWE-916 Use of Password Hash With Insufficient Computational Effort