LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

BD monitors Win32k flaws CVE-2019-1458 and CVE-2019-1468

MedDevice Cyber Staff · Feb 18 · 2 min read · Via BD bulletin: Product Security Bulletin for Third-Party Win32k Vulnerability

BD published a third-party bulletin on February 18, 2020 on two Microsoft Win32k vulnerabilities, CVE-2019-1458 and CVE-2019-1468, which Microsoft patched. BD states they are not specific to BD products and that it has received no reports of exploitation on BD products.

Win32k is the kernel-mode side of the Windows graphics subsystem, and bugs there are a standard step from user to SYSTEM. Every Windows-based instrument inherits them, which is why manufacturers publish these bulletins even with nothing BD-specific to fix.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft patched CVE-2019-1458 and CVE-2019-1468. Customers should apply those updates to Windows-based BD systems under BD's validated patch guidance. Restrict local accounts on instrument workstations so a privilege escalation has nowhere to start.

Apply Microsoft's fixes. Install the Win32k updates on Windows-based BD systems once BD validates them.
Reduce local accounts. Remove interactive logins that clinical workflows do not need.
Watch BD's bulletin page. Check BD's product security page for product-specific guidance.

For Device ManufacturersFix the class in the product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

What is BD's position on CVE-2019-1458?

In a February 18, 2020 bulletin BD said it is monitoring Microsoft Win32k vulnerabilities CVE-2019-1458 and CVE-2019-1468, which Microsoft patched, that they are not specific to BD products, and that it has no reports of exploitation on BD products.

Has Microsoft patched CVE-2019-1468?

Yes. BD's February 18, 2020 bulletin notes Microsoft patched both Win32k vulnerabilities, CVE-2019-1458 and CVE-2019-1468.

← Back to Vulnerabilities