LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Fujifilm Healthcare // Products

SCENARIA View Phase 5.0

System, X-Ray, Tomography, Computed. Attributes come from Fujifilm Healthcare's own public documentation for this product.

Attributes

Signals
Remote access Wired network DICOM or image parsing Named operating system
Properties (MITRE EMB3D)
PID-23 Device includes OS/kernel PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces PID-41 Device exposes remote network services
Attributes: component types
Generic Application Generic Hardware Local Application Local Service Operating System Sensor Modules User Interface
Attributes: interface types
TCP
Attributes: assets
Patient Data Software Configuration
Attributes: dataflows
CT system to RemoteRecon external PC (image reconstruction parameters) CT system to external devices via DICOM (volume datasets) Detector to reconstruction sub-system (scan data) Reconstruction sub-system to Computer Workstation (cross-sectional images)

Matched threat intel

2

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Fujifilm Healthcare has said.

AdvisoryDateSharedFujifilm Healthcare status
Philips Brilliance CT and MX8000 Dual EXP systems carry hard-coded credential weaknessMay 1, 2018Same FDA device typeNo feedback feed from manufacturer
Login credentials exposed on the workstation in a GE imaging viewerMar 16, 2026Same signalsNo feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-204 Untrusted Programs Can Access Privileged OS Functions TID-205 Existing OS Tools Maliciously Used for Device Manipulation TID-219 OS/Kernel Privilege Escalation TID-311 Default Credentials TID-328 Hardcoded Credentials TID-329 Improper Password Storage
CWE weaknesses
CWE-1392 Use of Default Credentials CWE-427 Uncontrolled Search Path Element CWE-522 Insufficiently Protected Credentials CWE-798 Use of Hard-coded Credentials