LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Olympus // Products

Evis EUS Endoscopic Ultrasound Center Olympus EU-ME3

System, Imaging, Pulsed Doppler, Ultrasonic. Attributes come from Olympus's own public documentation for this product.

Attributes

Signals
Patient or study database USB port Field-updatable firmware
Properties (MITRE EMB3D)
PID-123 Device includes ROM, VRAM, or removable Storage PID-14 Device includes external peripheral interconnects (e.g., USB, Serial) PID-27 Device includes support for firmware/software updates PID-31 Application-level software is present and running on the device
Attributes: component types
Circuit Board Display Firmware Generic Application Memory Sensor Modules Storage User Interface
Attributes: interface types
USB
Attributes: assets
Report Data Sensor Data
Attributes: dataflows
EU-ME3 to external recording device (printed and recorded images) EU-ME3 to internal memory (recorded movies) Ultrasound transducers to EU-ME3 (real-time ultrasound images)

Matched threat intel

3

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Olympus has said.

AdvisoryDateSharedOlympus status
Philips Gemini PET/CT systems write sensitive data to removable media without access controlMar 25, 2021Same property (MITRE EMB3D)PID-123No feedback feed from manufacturer
Boston Scientific ZOOM LATITUDE PRM uses a hard-coded key and leaves patient data unencryptedOct 19, 2017Same property (MITRE EMB3D)PID-123No feedback feed from manufacturer
Medtronic CareLink 9790, 2090 and Encore 29901 programmers store patient data unencryptedDec 13, 2018Exposed to the same EMB3D threatTID-108No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-221 Authentication Bypass By Message Replay TID-226 Device leaks security information in logs TID-317 Predictable Cryptographic Key TID-324 HTTP Direct Object Reference TID-329 Improper Password Storage
CWE weaknesses
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-284 Improper Access Control CWE-294 Authentication Bypass by Capture-replay CWE-321 Use of Hard-coded Cryptographic Key CWE-639 Authorization Bypass Through User-Controlled Key CWE-916 Use of Password Hash With Insufficient Computational Effort