LIVE FEED
Stryker cut its 2026 guidance October 30 after missing third quarter sales and earnings estimates; CEO Kevin Lobo named a cyber incident, a July SAP rollout, and slow new product uptake alongside a broader hip and knee market slowdown. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Stryker cut its 2026 guidance October 30 after missing third quarter sales and earnings estimates; CEO Kevin Lobo named a cyber incident, a July SAP rollout, and slow new product uptake alongside a broader hip and knee market slowdown. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed.
Sunday, November 1, 2026 Issue #500  ·  Est. 2025
Independent brief for device makers
VULNERABILITY ANALYSIS // MEDDEVICE CYBER
Vulnerability

STERIS issues third-party PHP advisory SAN-2026-00001

STERIS published advisory SAN-2026-00001, Third Party Vulnerability: PHP, on October 30, 2026, its first product security advisory listed for 2026.

MedDevice Cyber Staff  ·  2 days ago  ·  2 min read  ·  Via STERIS
02
Intelligence
Stryker cuts 2026 guidance, and the cyberattack is still part of the story

Stryker cut its full year 2026 adjusted EPS guidance to $14.80 to $14.90 after third quarter sales of $6.5 billion missed Wall Street's $6.62 billion estimate. CEO Kevin Lobo named a cyber incident, a July SAP rollout and a hip and knee slowdown as the reasons, seven months after the March cyberattack that disrupted manufacturing and order processing.

2 days ago  ·  3 min read  ·  Via MedTech Insight
Sponsored

AI-Native Medical Device Pentesting and Vulnerability Management.
03
Patient sues University Hospitals over October cyberattack that took MyChart offline
INTELLIGENCE  ·  4 days ago
04
Boston Scientific puts the August cyberattack at $150 million of lost third quarter sales
INCIDENT UPDATE  ·  4 days ago
05
University of New Mexico Health cyberattack forces ambulance diversions
INTELLIGENCE  ·  6 days ago
Browse by Threat
CISA KEV · MITRE EMB3D · ATT&CK · CWE

Latest Intelligence

Updated 2 days ago
Vulnerability
Fresenius says Fresenius Kabi infusion, transfusion and compounding products are not affected by PHP2Shell

Fresenius's October 26, 2026 PHP2Shell advisory lists Fresenius Kabi infusion, transfusion and compounding products as not affected by CVE-2026-109618 and CVE-2026-109619 because they do not rely on PHP.

Fresenius6 days ago2 min read
Vulnerability
Siemens Healthineers acknowledges critical PHP flaws CVE-2026-109618 and CVE-2026-109619

Siemens Healthineers posted an October 26, 2026 customer notification on the critical PHP flaws CVE-2026-109618 and CVE-2026-109619, with product details only on teamplay Fleet and myvarian.

Siemens Healthineers6 days ago2 min read
Vulnerability
Leica Biosystems posts PHP2Shell notice for PHP versions before 8.5.11

Leica Biosystems said on October 23, 2026 it had been notified of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP prior to 8.5.11.

Leica BiosystemsOct 232 min read
Vulnerability
Vision RT says AlignRT and its clinical systems are not affected by PHP2Shell

Vision RT said on October 23, 2026 that its clinical systems, including AlignRT, are not affected by PHP2Shell, CVE-2026-109618 and CVE-2026-109619.

Vision RTOct 232 min read
Four unpatched flaws disclosed in HAPI FHIR, the server library behind Smile CDR
Vulnerability
Four unpatched flaws disclosed in HAPI FHIR, the server library behind Smile CDR

A researcher found four flaws in HAPI FHIR, the open-source Java library that underpins Smile Digital Health's Smile CDR and at least eight other commercial platforms. The worst, CVE-2026-113874 at 8.1 on CVSS v3.1, lets an authenticated user override the partition header on a Bundle entry and read or write another tenant's clinical data. None of the four has a confirmed fix yet.

oss-security mailing listOct 223 min read
Quest Diagnostics discloses breach of its Quanum lab ordering system
Intelligence
Quest Diagnostics discloses breach of its Quanum lab ordering system

Quest Diagnostics paused access to Quanum Lab Services Manager on October 21 after finding unauthorized access, then disclosed the incident in an SEC filing the next day without a scope figure. The company says patient records were accessed; it has not said how many.

SECOct 223 min read
Regulatory Watch
01
AdvaMed to Build Industry Cybersecurity Standards After a Year of Device Maker Attacks
MedTech Dive · Oct 19
 02
HSCC publishes a playbook assigning who can touch a clinical AI tool after it fails
Industrial Cyber · Oct 8
 03
Senate passes S. 3315, mandating MFA and encryption for every HIPAA covered entity
Congress.gov · Sep 30
 04
Labcorp to pay $2.3 million and submit to vendor security audits for five years
New York Attorney General · Sep 24
Vendor & Market
Sponsored

AI-Native Medical Device Pentesting and Vulnerability Management.
From the directory

Armis  ·  Asimily  ·  Blue Goat Cyber  ·  Claroty (Team82)  ·  Cybellum  ·  Finite State  ·  MedCrypt  ·  MedSec  ·  Ordr  ·  Promenade Software  ·  Sequoia (GDT)

Browse the vendor directory →