LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Philips’ July advisory run is a lesson in where device risk actually lives

MedDevice Cyber Staff · 6 days ago · 3 min read · Via Philips Product Security

Philips published or updated four advisories between early June and July 30. A Trellix breach response (no Philips products known impacted). The OFFIS DCMTK vulnerabilities. Windows kernel CVE-2026-45657 across Holter, IntelliSpace ECG, ST80i and PIC iX. And the Defender findings, BlueHammer, RedSun and UnDefend, touching IntelliVue and UroNav.

None of it is Philips code. A monitoring platform inherits the Windows kernel. An ECG cart inherits Defender. Every imaging product inherits DICOM toolkits. Now device makers inherit their security vendors’ breaches too.

The kernel RCE reaching PIC iX 4.x is the one to watch. A patient information center is the box a hospital never wants to reboot. Which is exactly where patch lag runs longest.

This is what working PSIRT output looks like. Fast, specific, honest about not-impacted. Forty plus large manufacturers publish nothing at all. That gap is the real story.

Remediation Desk

None of the July advisories were for a bug the vendor wrote; they were in a security tool, a DICOM toolkit, a Windows kernel path and a Defender bypass that the product depends on. The lesson is that most device risk lives in the supply chain, so track upstream and operating-system exposure with the same rigor as first-party code.

Extend monitoring past your own code. Watch advisories for every third-party component and platform your product runs on, since that is where these four originated.
Keep the SBOM current and queryable. When an upstream advisory drops, you need to answer are we affected in minutes, which requires a live SBOM rather than a one-time export.
Pre-plan platform patch paths. Know in advance how you deliver operating-system and dependency patches to fielded devices so a kernel-level advisory does not strand you.

Sources

Philips Product Security ↗

← Back to Vulnerabilities

Philips’ July advisory run is a lesson in where device risk actually lives

More Vulnerabilities