LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Philips // Products

Philips IntelliSpace Cardiovascular

System, Image Processing, Radiological. Attributes come from Philips's own public documentation for this product.

Attributes

Signals
Patient or study database File import User accounts Handles patient data Cloud connectivity Remote access HL7 or FHIR integration DICOM or image parsing Physiological waveform processing Named operating system Hospital network
Properties (MITRE EMB3D)
PID-23 Device includes OS/kernel PID-31 Application-level software is present and running on the device PID-32 Device includes the ability to deploy custom or external programs (e.g., ladder logic, compiled binaries) PID-33 Device includes interactive applications, services, or user interfaces PID-332 Device includes authenticated services PID-41 Device exposes remote network services PID-4113 Device includes cryptographic functions for sensitive data, such as encryption or authentication
Platform
Android companion app: Android app Android Windows Windows 7 Windows XP Web browser: Google Chrome OpenSSL
Attributes: materials
IntelliBridge Enterprise IntelliSpace Cardiovascular PIIC iX Windows RD Gateway Windows Remote Desktop Client Xcelera Xcelera 4.1 vSphere
Attributes: component types
API Cloud Service Generic Application Library Local Application Local Service Operating System Platform User Interface Web Application
Attributes: interface types
Ethernet TCP
Attributes: assets
Patient Data Report Data
Attributes: dataflows
Cardiovascular Workspace to VNA via automatic data synchronization Imaging modalities to IntelliSpace Cardiovascular via DICOM import IntelliSpace Cardiovascular to HIS/EMR via HL7 and enterprise interfaces IntelliSpace Cardiovascular to third-party medical devices via URL launch

Matched threat intel

5

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Philips has said.

AdvisoryDateSharedPhilips status
Unrestricted file upload on a PACS points straight at code executionApr 10, 2025Same FDA device typeNo feedback feed from manufacturer
Mira’s cloud login accepted any password and returned a session tokenAug 11, 2026Same platformAndroid 4.5No feedback feed from manufacturer
Dario Health glucose monitoring app and servers exposed cross-user health dataFeb 27, 2025Same platformAndroid appNo feedback feed from manufacturer
B. Braun OnlineSuite AP 3.0 and earlier allows unauthenticated file upload and DLL hijackingOct 22, 2020Same signalsNo feedback feed from manufacturer
Medtronic MyCareLink 24950 and 24952 monitors store upload credentials in a recoverable formatAug 7, 2018Same signalsNo feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-221 Authentication Bypass By Message Replay TID-226 Device leaks security information in logs TID-305 Program Executes Dangerous System Calls TID-310 Remotely Accessible Unauthenticated Services TID-313 Unauthenticated Session Changes Credential TID-314 Passwords Can Be Guessed Using Brute-Force Attempts TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-317 Predictable Cryptographic Key TID-319 Cross Site Scripting (XSS) TID-323 Path Traversal TID-324 HTTP Direct Object Reference TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-401 Undocumented Protocol Features TID-406 Unauthorized Messages or Connections TID-408 Unencrypted Sensitive Data Communication
CWE weaknesses
CWE-1390 Weak Authentication CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-22 Improper Limitation of a Pathname to a Restricted Directory CWE-284 Improper Access Control CWE-287 Improper Authentication CWE-294 Authentication Bypass by Capture-replay CWE-306 Missing Authentication for Critical Function CWE-321 Use of Hard-coded Cryptographic Key CWE-434 Unrestricted Upload of File with Dangerous Type CWE-639 Authorization Bypass Through User-Controlled Key CWE-916 Use of Password Hash With Insufficient Computational Effort