LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips reviews IntelliSpace PACS and Vue PACS after F5 BIG-IP breach directive

MedDevice Cyber Staff · Oct 17 · 2 min read · Via Philips product security advisories 2025

Philips posted a notice on October 17, 2025 following CISA Emergency Directive 26-01 on vulnerabilities in F5 BIG-IP hardware and software. Per the directive, a nation-state affiliated threat actor breached F5's systems and stole files, including portions of BIG-IP source code. The listed products are IntelliSpace PACS, Philips PRS and Vue PACS.

Stolen source code shortens the road to new exploits. Any BIG-IP load balancer in front of a PACS deserves the directive's full checklist: inventory, patch, and take the management interface off public networks.

Philips said it was closely monitoring the situation.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Inventory any F5 BIG-IP devices that front IntelliSpace PACS, Philips PRS or Vue PACS and apply F5's updates per CISA Emergency Directive 26-01. Remove BIG-IP management interfaces from public networks.

Inventory BIG-IP. List every F5 BIG-IP device in the PACS delivery path.
Patch per the directive. Apply F5 updates on the schedule ED 26-01 sets.
Hide management. Keep BIG-IP management interfaces off public and user networks.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Off-the-shelf software

Contributing

Wired network Hospital network

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Why did Philips list PACS products under CISA Emergency Directive 26-01?

On October 17, 2025 Philips listed IntelliSpace PACS, Philips PRS and Vue PACS after CISA Emergency Directive 26-01, which followed a nation-state breach of F5 that exposed portions of BIG-IP source code.

What is CISA Emergency Directive 26-01?

CISA Emergency Directive 26-01 addresses vulnerabilities in F5 BIG-IP products after a nation-state affiliated actor breached F5 and stole files including BIG-IP source code. Philips responded on October 17, 2025.

← Back to Vulnerabilities