LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Varian // Products

ProBeam 360 Proton Therapy System v3.0

System, Radiation Therapy, Charged-Particle, Medical. Attributes come from Varian's own public documentation for this product.

Attributes

Signals
Therapy delivery DICOM or image parsing Field-updatable firmware
Properties (MITRE EMB3D)
PID-27 Device includes support for firmware/software updates PID-31 Application-level software is present and running on the device PID-4113 Device includes cryptographic functions for sensitive data, such as encryption or authentication
Attributes: component types
Firmware Generic Application Library Local Service
Attributes: interface types
TCP

Matched threat intel

21

Advisories in our coverage that share an attribute with this product. A shared attribute is a lead, not a finding. The status column shows only what Varian has said.

AdvisoryDateSharedVarian status
Mira’s cloud login accepted any password and returned a session tokenAug 11, 2026Same property (MITRE EMB3D)PID-411No feedback feed from manufacturer
Compounding software that did not encrypt its database traffic by defaultMay 15, 2026Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
A legacy cardiology system, end-of-service since 2014, recalled for securityJun 10, 2025Same property (MITRE EMB3D)PID-411No feedback feed from manufacturer
A DICOM viewer that did not check its update server certificateFeb 20, 2025Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
MicroDicom DICOM Viewer 2024.03 fails to validate its update server certificateFeb 6, 2025Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
A patient monitor with a hidden backdoor that phones homeJan 30, 2025Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
Baxter Welch Allyn Connex Spot Monitor used a default cryptographic keyMay 30, 2024Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips PIC iX and Efficia CM Series carry a hard-coded key and weak cryptoNov 18, 2021Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
GE Healthcare imaging and ultrasound systems expose default service credentialsDec 8, 2020Same property (MITRE EMB3D)PID-411No feedback feed from manufacturer
BIOTRONIK CardioMessenger II-S home monitors store recoverable credentials and leak them in cleartextJun 18, 2020Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips IntelliBridge EC40 and EC80 hubs allow weak SSH ciphersNov 14, 2019Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Philips HealthSuite Health Android app uses encryption too weak for its dataDec 6, 2018Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Medtronic MyCareLink 24950 and 24952 monitors store upload credentials in a recoverable formatAug 7, 2018Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Medtronic 2090 CareLink and 29901 Encore programmers accept updates without verifying their originFeb 27, 2018Same property (MITRE EMB3D)PID-27No feedback feed from manufacturer
Boston Scientific ZOOM LATITUDE PRM uses a hard-coded key and leaves patient data unencryptedOct 19, 2017Same property (MITRE EMB3D)PID-4113No feedback feed from manufacturer
Stored passwords recoverable in a Siemens imaging platformFeb 10, 2026Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
BD Alaris Infusion Central leaves a recoverable database password after installationFeb 16, 2023Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
Baxter Phoenix hemodialysis system sends treatment and prescription data in cleartextJun 18, 2020Exposed to the same EMB3D threatTID-411No feedback feed from manufacturer
Medtronic CareLink 9790, 2090 and Encore 29901 programmers store patient data unencryptedDec 13, 2018Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer
Philips Alice 6 through R8.0.3 lacks authentication and encryption between nodesMar 27, 2018Exposed to the same EMB3D threatTID-411No feedback feed from manufacturer
Philips IntelliSpace Cardiovascular and Xcelera store credentials in cleartextNov 14, 2017Exposed to the same EMB3D threatTID-221No feedback feed from manufacturer

Threats and weaknesses in matched advisories

MITRE EMB3D threats
TID-116 Latent Privileged Access Port TID-210 Device Vulnerabilities Unpatchable TID-211 Device Allows Unauthenticated Firmware Installation TID-213 Faulty FW/SW Update Integrity Verification TID-215 Unencrypted SW/FW Updates TID-221 Authentication Bypass By Message Replay TID-222 Critical System Service May Be Disabled TID-224 Excessive Access via Software Diagnostic Features TID-310 Remotely Accessible Unauthenticated Services TID-311 Default Credentials TID-313 Unauthenticated Session Changes Credential TID-314 Passwords Can Be Guessed Using Brute-Force Attempts TID-316 Incorrect Certificate Verification Allows Authentication Bypass TID-317 Predictable Cryptographic Key TID-318 Insecure Cryptographic Implementation TID-323 Path Traversal TID-327 Out of Bounds Memory Access TID-328 Hardcoded Credentials TID-329 Improper Password Storage TID-401 Undocumented Protocol Features TID-404 Remotely Triggerable Deadlock/DoS TID-406 Unauthorized Messages or Connections TID-408 Unencrypted Sensitive Data Communication TID-411 Weak/Insecure Cryptographic Protocol
CWE weaknesses
CWE-1104 Use of Unmaintained Third Party Components CWE-1329 Reliance on Component That is Not Updateable CWE-1390 Weak Authentication CWE-1392 Use of Default Credentials CWE-287 Improper Authentication CWE-294 Authentication Bypass by Capture-replay CWE-306 Missing Authentication for Critical Function CWE-319 Cleartext Transmission of Sensitive Information CWE-321 Use of Hard-coded Cryptographic Key CWE-326 Inadequate Encryption Strength CWE-345 Insufficient Verification of Data Authenticity CWE-494 Download of Code Without Integrity Check CWE-506 Embedded Malicious Code CWE-522 Insufficiently Protected Credentials CWE-798 Use of Hard-coded Credentials CWE-912 Hidden Functionality CWE-916 Use of Password Hash With Insufficient Computational Effort