LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips lists EncoreAnywhere and VuePACS as affected by Telerik CVE-2019-18935 deserialization flaw

MedDevice Cyber Staff · Dec 9 · 3 min read · Via Philips security advisory

Philips published a notice on December 9, 2019 naming EncoreAnywhere and VuePACS in connection with CVE-2019-18935. Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.

Insecure deserialization in an upload handler is a well-worn route to code execution on the web server. Both named products are web applications that handle patient data.

Telerik fixed it in later releases. Any web front end built on the control should be checked by version, not by assumption.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

CVE-2019-18935 affects Telerik UI for ASP.NET AJAX through 2019.3.1023, used by EncoreAnywhere and VuePACS. Obtain the Philips-validated update that moves the component past that version and restrict who can reach the upload endpoints.

Get the validated update. Ask Philips for the EncoreAnywhere and VuePACS builds with a fixed Telerik version.
Restrict upload endpoints. Block external access to RadAsyncUpload handlers where the application allows it.
Watch web logs. Look for unexpected requests to Telerik.Web.UI.WebResource.axd.
Track web components. Record third-party UI libraries in the SBOM with exact versions.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

File import Off-the-shelf software Handles patient data

EncoreAnywhere

PID-311 Web interface File import

VuePACS

PID-311 Web interface

Fix the class in your product

The product turns untrusted bytes into objects without constraint. As the maker, stop deserializing untrusted data into arbitrary types: move to a schema-validated format across trust boundaries, and set any framework type filter to its most restrictive value.

Allow-list types. Validate structure and allow-list expected types before constructing anything.
Restrict the framework. On .NET Remoting set TypeFilterLevel to Low, or replace remoting with an authenticated schema-checked API.
Block the endpoint. Firewall the deserialization port so untrusted hosts cannot reach it.

Mapped EMB3D mitigations

Questions & Answers

Is Philips VuePACS affected by Telerik CVE-2019-18935?

Philips listed VuePACS and EncoreAnywhere on December 9, 2019 as affected by CVE-2019-18935, a .NET deserialization vulnerability in the RadAsyncUpload function of Telerik UI for ASP.NET AJAX through 2019.3.1023.

What is CVE-2019-18935 in Telerik UI for ASP.NET AJAX?

CVE-2019-18935 is a .NET deserialization vulnerability in the RadAsyncUpload function of Progress Telerik UI for ASP.NET AJAX through 2019.3.1023.

← Back to Vulnerabilities