LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Varian // Products

Identify

Accelerator, Linear, Medical. Attributes come from Varian's own public documentation for this product.

Attributes

Signals
File import Web interface Closed-loop control Therapy delivery Handles patient data Remote access DICOM or image parsing Physiological waveform processing Hospital network
Properties (MITRE EMB3D)
PID-311 Device includes the usage of a web/HTTP applications PID-33 Device includes interactive applications, services, or user interfaces PID-41 Device exposes remote network services
Attributes: component types
Display Local Application Local Service Sensor Modules User Interface Web Application
Attributes: interface types
RFID TCP
Attributes: assets
Calibration Data Report Data Sensor Data
Attributes: dataflows
IDENTIFY to TrueBeam couch (couch position correction) IDENTIFY to radiotherapy devices (motion information to synchronize image acquisition or treatment delivery)

Matched threat intel

1

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Varian has said.

AdvisoryDateSharedVarian status
Philips IntelliVue monitors and PIC iX skip certificate revocation and crash on bad inputSep 10, 2020Same property (MITRE EMB3D)PID-311No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-222 Critical System Service May Be Disabled TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-319 Cross Site Scripting (XSS) TID-404 Remotely Triggerable Deadlock/DoS TID-405 Network Stack Resource Exhaustion
CWE weaknesses
CWE-20 Improper Input Validation CWE-400 Uncontrolled Resource Consumption CWE-476 NULL Pointer Dereference