LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips lists ST80i and PIC iX under Windows CLFS flaws CVE-2025-32706 and CVE-2025-30397

MedDevice Cyber Staff · May 20 · 2 min read · Via Philips product security advisories 2025

Philips posted a notice on May 20, 2025 on CVE-2025-32706 and CVE-2025-30397. Philips placed both in the Microsoft Common Log File System (CLFS). If exploited, they let threat actors elevate privileges and execute code over a network. The listed products are the ST80i and PIC iX.

This is the second CLFS notice from Philips in five weeks. Philips policy allows only Philips authorized changes on these systems, so the patch reaches the device through Philips service.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Philips validated Windows May 2025 updates for CVE-2025-32706 and CVE-2025-30397 on ST80i and PIC iX hosts through Philips service.

Pull the product list. Match the listed Philips products against the installed base, including catalogue numbers and versions.
Ask Philips service for the status. Get the validated patch or the interim mitigation for each listed system before applying anything yourself.
Segment the affected hosts. Keep the listed workstations and servers on a clinical VLAN with no direct internet or guest network exposure.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Off-the-shelf software Hospital network

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by CVE-2025-32706 and CVE-2025-30397?

Philips listed the ST80i and PIC iX on May 20, 2025 under CVE-2025-32706 and CVE-2025-30397, Windows vulnerabilities that allow privilege elevation and code execution over a network.

Is Philips PIC iX affected by Windows CLFS vulnerabilities?

Yes. PIC iX appears in the Philips May 20, 2025 notice on CVE-2025-32706 and CVE-2025-30397, and PIC iX was not on the April 16, 2025 CLFS list.

← Back to Vulnerabilities