LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Varian // Products

ARIA Radiation Therapy Management System

System, Planning, Radiation Therapy Treatment. Attributes come from Varian's own public documentation for this product.

Attributes

Signals
Patient or study database File import Handles patient data Remote access HL7 or FHIR integration DICOM or image parsing Hospital network
Properties (MITRE EMB3D)
PID-31 Application-level software is present and running on the device PID-33 Device includes interactive applications, services, or user interfaces PID-332 Device includes authenticated services PID-34 Device stores logs of application events and information PID-41 Device exposes remote network services
Attributes: component types
Generic Application Local Application Local Service User Interface
Attributes: interface types
TCP
Attributes: assets
Log Data Patient Data
Attributes: dataflows
ARIA to HL7-compliant billing software (charges and RVU export) ARIA to Microsoft Outlook (schedule synchronization) ARIA to hospitals (patient data transfer) Other DICOM-compliant systems to ARIA (treatment plans import)

Matched threat intel

8

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Varian has said.

AdvisoryDateSharedVarian status
Empty passwords and cleartext storage in a home cardiac monitorJul 24, 2025Exposed to the same EMB3D threatTID-328No feedback feed from manufacturer
Default credentials across a line of diagnostic instrumentsDec 17, 2024Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Philips Vue PACS before 12.2.8.410 ships a default database password and can be overloadedJul 18, 2024Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Viper LT system uses hard-coded credentials that expose patient dataMar 3, 2022Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Pyxis dispensing and supply systems ship with hard-coded credentials across 24 productsMar 3, 2022Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
GE Aestiva and Aespire anesthesia devices can have alarms silenced through unsecured terminal serversJul 9, 2019Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
Philips DoseWise Portal hard-codes its database credentials and stores logins in clear textAug 17, 2017Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer
BD Kiestra PerformA and KLA Journal Service use a hard-coded database passwordMar 23, 2017Exposed to the same EMB3D threatTID-311No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-111 Untrusted External Storage TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-326 Insecure Deserialization TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-405 Network Stack Resource Exhaustion TID-406 Unauthorized Messages or Connections
CWE weaknesses
CWE-1188 Insecure Default Initialization of Resource CWE-1392 Use of Default Credentials CWE-276 Incorrect Default Permissions CWE-502 Deserialization of Untrusted Data CWE-522 Insufficiently Protected Credentials CWE-798 Use of Hard-coded Credentials