LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips discloses vulnerabilities in PageWriter TC10 to TC70 cardiographs

MedDevice Cyber Staff · Aug 16 · 2 min read · Via Philips security advisory

Philips published an advisory on August 16, 2018 concerning potential security vulnerabilities that may affect the PageWriter TC10, TC20, TC30, TC50 and TC70 cardiograph systems. The disclosure follows its Coordinated Vulnerability Disclosure Policy and U.S. FDA postmarket guidance.

The brief does not list the weaknesses or fixed software. Resting ECG carts move between rooms and get handled by many staff, so physical access is a weaker barrier than it is for racked equipment.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips disclosed vulnerabilities in the PageWriter TC10 to TC70 cardiographs; the brief names no fixed version. Contact Philips service for the update and control physical and network access to the carts.

Request the update. Ask Philips service for the software that addresses the August 2018 advisory.
Control physical access. Store carts in supervised areas when not in use.
Limit network exposure. Allow cardiograph traffic only to the ECG management system.
Change service credentials. Confirm with Philips how service passwords are managed on each cart.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Physiological waveform processing

Contributing

Handles patient data Hospital network

PageWriter TC Series

Physiological waveform processing

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

Which Philips PageWriter models are in the August 2018 security advisory?

Philips listed the PageWriter TC10, TC20, TC30, TC50 and TC70 cardiograph systems in its August 16, 2018 advisory.

How do I fix the Philips PageWriter TC vulnerabilities?

Philips directs PageWriter TC10 to TC70 customers to their service representative for patch availability for their configuration.

← Back to Vulnerabilities