LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Leica Biosystems posts PHP2Shell notice for PHP versions before 8.5.11

MedDevice Cyber Staff · Oct 23 · 2 min read · Via Leica Biosystems product security advisories

Leica Biosystems posted an advisory on October 23, 2026, updated October 29, after being notified of two vulnerabilities it calls security critical in PHP prior to 8.5.11: CVE-2026-109618 and CVE-2026-109619. The company said exploitation may allow an unauthenticated network attacker to execute code on a webserver.

The summary on its advisory index names no Leica Biosystems product, so a pathology lab has to open the linked detail to learn whether any scanner, image server or management application in its environment runs an affected PHP build. Until that answer is in writing, treat every lab web front end that bundles PHP as in scope.

Are you a representative of Leica Biosystems? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Leica Biosystems was notified of CVE-2026-109618 and CVE-2026-109619 in PHP prior to 8.5.11, which may let an unauthenticated network attacker execute code on a webserver. The index entry names no affected Leica Biosystems product and no fixed product release. Confirm with Leica Biosystems which installed systems carry PHP and keep their web services off untrusted networks until that is settled.

Read the detail page. Open the Leica Biosystems PHP2Shell advisory detail and record which products, if any, it lists.
Inventory PHP. Ask Leica Biosystems support which installed systems run PHP and at what version.
Restrict web access. Limit inbound access to any Leica Biosystems web service to the lab subnet until PHP 8.5.11 or a vendor fix is confirmed.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Off-the-shelf software

Contributing

Web interface

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which PHP versions are affected by the PHP2Shell flaws in the Leica Biosystems advisory?

Leica Biosystems said on October 23, 2026 that CVE-2026-109618 and CVE-2026-109619 affect PHP prior to 8.5.11 and may allow an unauthenticated network attacker to execute code on a webserver.

Does the Leica Biosystems PHP2Shell notice name affected products?

No. The Leica Biosystems advisory index entry of October 23, 2026, updated October 29, names no product; it links to a detail page on CVE-2026-109618 and CVE-2026-109619 in PHP prior to 8.5.11.

← Back to Vulnerabilities