LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips discloses availability flaw in e-Alert hardware 2.7 and prior

MedDevice Cyber Staff · Mar 29 · 2 min read · Via Philips product security advisories, 2022 archive

Philips issued an advisory on March 29, 2022, for the Philips e-Alert hardware solution, versions 2.7 and prior, under its Coordinated Vulnerability Disclosure Policy. The company identified one potential vulnerability that may allow an attacker within the same subnet to impact system availability.

The attacker needs a foothold on the same subnet, which puts the device's network segment at the center of the fix. Isolate e-Alert units on their own VLAN and ask Philips service for the remediation path.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The flaw affects Philips e-Alert hardware versions 2.7 and prior and needs same-subnet access. Restrict the subnet, and get the remediation or upgrade path from Philips service.

Isolate the unit. Place e-Alert hardware on a segment with no general-purpose hosts.
Check the version. Confirm which units run version 2.7 or earlier.
Ask for the fix. Request the remediation path for affected e-Alert units from Philips service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Wired network

e-Alert

PID-41

Fix the class in your product

Malformed or excessive input pushes the service over, and on a monitor that means the screen goes dark. As the maker, validate and bound every input at the boundary, handle malformed messages as a defined error path, and watchdog the clinical display so a fault recovers to a safe view.

Validate and bound input. Enforce type, size, and rate limits; null-check before you dereference.
Fail safe. Handle malformed input as a defined error path, never an unchecked dereference.
Watchdog the display. On a monitor, restore the clinical view quickly and safely after a fault.

Mapped EMB3D mitigations

Questions & Answers

What is the Philips e-Alert vulnerability?

Philips disclosed on March 29, 2022, one potential vulnerability in the e-Alert hardware solution, versions 2.7 and prior, that may allow an attacker within the same subnet to impact system availability.

Which Philips e-Alert versions are affected?

Philips e-Alert hardware solution versions 2.7 and prior are affected by the availability vulnerability disclosed on March 29, 2022.

← Back to Vulnerabilities