LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips e-Alert units through R2.1 send communication unencrypted

MedDevice Cyber Staff · Aug 30 · 2 min read · Via Philips security advisory

Philips published an advisory on August 30, 2018 concerning potential unencrypted communication vulnerabilities in Philips e-Alert service units up to and including R2.1.

If successfully exploited, this potential vulnerability may allow an attacker within the same subnet to impact or compromise customer contact details, system integrity, and/or system availability. Contact details are the stated data at risk, but integrity and availability of the alerting unit matter more to the service team that depends on it.

Same-subnet access is the precondition, so put the unit on a segment nobody else shares.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips e-Alert units up to and including R2.1 send communication unencrypted. Operators should contact Philips service about a later release and isolate the unit on a dedicated subnet so no untrusted host shares its broadcast domain.

Identify R2.1 and earlier units. Check the software version on every e-Alert unit.
Isolate the subnet. Place e-Alert units on a segment with no general workstations.
Ask Philips about upgrades. Request the release that adds encrypted communication.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

Remote access

e-Alert

PID-4112 Wired network

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

What is the Philips e-Alert unencrypted communication vulnerability?

Philips disclosed on August 30, 2018 that e-Alert service units up to and including R2.1 communicate unencrypted, which could let an attacker on the same subnet affect customer contact details, system integrity or availability.

Which Philips e-Alert versions are affected?

Philips e-Alert service units up to and including R2.1 are affected by the unencrypted communication vulnerabilities.

← Back to Vulnerabilities