LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips reports no product impact from Citrix NetScaler bulletin covering CVE-2026-88771 to CVE-2026-88778

MedDevice Cyber Staff · Sep 29 · 2 min read · Via Philips security advisories

Philips published a notice on September 29, 2026 on a Citrix security bulletin covering several critical vulnerabilities in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 through CVE-2026-88778. Philips says no Philips products are known to be impacted and that it continues to analyze the matter.

The notice went up the same day as a separate Philips advisory on NetScaler CVE-2026-19489 and CVE-2026-19490, and it carries the same note: all Philips RSN systems are fully protected against these vulnerabilities, and customers should not disconnect the PRS because that may stop Philips service teams from remote patching. A remote service link is exactly what a gateway compromise hands an attacker, so hospitals should verify that claim against their own connection logs.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips reports no known product impact from CVE-2026-88771 through CVE-2026-88778 and says its Remote Services Network is protected, so no Philips product patch is pending. Hospitals running their own NetScaler ADC or Gateway appliances should apply the Citrix fixes and review remote access sessions that pass through them.

Patch your own NetScaler appliances. Apply the Citrix fixes for CVE-2026-88771 through CVE-2026-88778 on any ADC or Gateway the hospital operates.
Keep the PRS connected. Follow Philips' advice not to disconnect the PRS, which carries remote patching.
Review remote service sessions. Check Philips remote connection logs for sessions outside scheduled service windows.
Watch the advisory page. Philips says further information will be posted on its Product Security Advisory page as appropriate.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Remote access

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Are Philips products affected by Citrix NetScaler CVE-2026-88771 through CVE-2026-88778?

Philips said on September 29, 2026 that no Philips products are known to be impacted by the critical NetScaler ADC and NetScaler Gateway vulnerabilities CVE-2026-88771 through CVE-2026-88778, and that it continues to analyze the matter.

Should hospitals disconnect Philips Remote Services after the September 2026 NetScaler bulletin?

No. Philips said on September 29, 2026 that all Philips RSN systems are fully protected against the NetScaler vulnerabilities CVE-2026-88771 through CVE-2026-88778 and advised customers not to disconnect the PRS, since that may stop remote patching.

← Back to Vulnerabilities