Patient data handling and AI-enabled device function both showed up far more often than their recent run rate, while the steadiest story of the month was how long a single legacy component disclosure can keep resurfacing.
A month with no single dramatic event but several quiet shifts in what regulators and manufacturers are expected to track: patient data exposure and AI-dependent function both rose well above their usual pace, MHRA pushed a sustained post-market campaign around patient hoists, and Hologic's Axeda bulletin kept reappearing across the record in slightly different forms. Worth reading for anyone keeping a technical file, an SBOM, or a post-market surveillance log current.
- Post-market surveillance and reporting · 17
- Exposure on the clinical network · 12
- Patient data handling · 12 ↑ rising
- AI-enabled device function · 7 ↑ rising
- Quality system expectations · 6 ↑ rising
- Third-party component provenance · 6
By jurisdiction: United Kingdom 56 · United States 48 · European Union 14
Patient data handling and AI-enabled function moved well above their usual pace
Both categories ran far ahead of their recent average this month, though the published evidence for patient data handling is limited to one clear item: Philips' disclosure of an attempted compromise of an enterprise server used to store internal data (CVE-2026-12569), first published mid-August and updated 14 Sep 2026, which Philips says has been contained with incident response completed. No single AI-enabled advisory is listed among the items here, so the rise in that category is a signal to watch rather than something this note can point to directly. Anyone maintaining a technical file that touches identifiable patient data or a predetermined change plan for a trained model may want to confirm what else is moving in those areas beyond what reached this record.
A single component disclosure, recurring
Hologic's Customer Technical Bulletin CTB-01038, addressing the PTC Axeda agent and Axeda Desktop Server referenced in CISA's ICSA-22-067-01, appeared repeatedly this month across Hologic's own advisory page — 3 Sep, 4 Sep, 1 Sep, and again 16 Sep — each instance describing the same underlying issue in Hologic Connect across supported Breast & Skeletal Health product systems. The bulletin itself dates to 2022. For anyone tracking third-party component provenance, this is a useful illustration of how a legacy dependency keeps being republished and restated rather than resolved outright, and worth checking whether Hologic Connect or Axeda-based remote support sits in any environment in scope.
Post-market surveillance stayed busy, driven by one sustained campaign
MHRA issued and then reinforced a National Patient Safety Alert on patient hoists and slings (NatPSA/2026/005/MHRA, 16 Sep 2026), with supporting case-example data and a roundup restating the same findings later in the month (29 Sep). Separately, Philips Respironics restated its long-running PE-PUR foam recall covering CPAP, Bi-Level PAP and ventilator devices (12 Sep, following a related notice 30 Sep), and Boston Scientific's urgent removal notice for the Superion Indirect Decompression System reached the record this month as well. This bears on anyone managing field actions or trending obligations, more than on any single new safety finding.
Clinical network exposure held steady, spread across several platforms
CISA published advisories for NextGen Healthcare Mirth Connect (SQL injection and XXE issues) and Orthanc DICOM Server (an integer overflow in PNG decoding, CVE-2026-87020), while Baxter restated a configuration notice (Abacus-2026-001) on transport encryption not being enabled by default between the Abacus client and its SQL Server backend across several September dates. Philips also continues tracking CISA's advisory on OFFIS DCMTK, affecting named imaging products. This bears on anyone running DICOM-handling infrastructure or integration engines reachable from a hospital network.
Worth reading
-
Please find our Security Advisories here
Philips Respironics' recall covering degraded PE-PUR foam in CPAP, BiLevel PAP and ventilator devices remains a live post-market action worth tracking for anyone handling affected units in a fleet.
-
Philips Respironics voluntary recall notice
This restatement extends the same recall to a named list of specific device families, useful for confirming exact model scope against any inventory.
-
National Patient Safety Alert: Patient hoists and slings (all types): risk of death and serious harm from falls (NatPSA/2026/005/MHRA)
MHRA's hoist and sling alert draws on sustained incident data since 2015 and sets out steps relevant to anyone responsible for patient-handling equipment in care settings.
-
NextGen Healthcare Mirth Connect
CISA's advisory on Mirth Connect names specific flaw classes (SQL injection, XXE) in an integration engine widely used for healthcare data exchange, worth checking against any deployment.
-
Breast & Skeletal Products Cybersecurity
The first of several Hologic bulletins this month on the Axeda agent, referencing a 2022 CISA advisory, worth confirming against the specific Windows and Hologic Connect configuration in use.
-
Breast & Skeletal Products Cybersecurity
A near-identical restatement of the same Axeda bulletin, useful mainly for confirming which currently supported product systems are explicitly named this time.
Looking ahead
FY 2027 medical device user fee rates take effect 1 October, a procedural date worth noting for anyone tracking FDA submission costs. Two comment periods close in mid-October — the NIST RFI on modernizing the National Vulnerability Database with AI, and CMS's proposed RAPID coverage pathway — both worth a look for anyone with a stake in how vulnerability data or coverage decisions get made going forward.
- FY 2027 medical device user fee rates take effect — Medical Device User Fee Rates for Fiscal Year 2027
- BOGO discount offer expires — Professional Development Academy - BOGO Special Until Oct 1: $500 off First Registration, Second Registration FREE!
- Vaccines and Related Biological Products Advisory Committee meeting — 10.115 Good Guidance Practices Radiation-Emitting Products Guidance Documents Contact FDA 1 (800) 638-2041 (301) 796-7100 DICE@fda.hhs.gov Information-Medical Devices / Radiation…
- Notification date for scholarship applicants — Move Beyond Production: Drive Real Impact with Health-ISAC!
- Deadline to submit a discussion topic for the workshop — Call for Topics/Registration Now Open for: “CVE Program Fall Technical Workshop” - October 29, 2026
- Health-ISAC member Board voting period closes — Last Chance: Health-ISAC 2026 Board Nomination Period Ends Today!
- NIST RFI comment period closes (60 days after August 12, 2026 Federal Register publication) — AdvaMed Cyber WG: REQ - Comment call for NIST RFI on modernizing the National Vulnerability Database using AI (estimated)
- Call for nominations issued — HSCC CWG Executive Committee Elections in the Fall
Get the brief by email
Once a month, what mattered in medical device regulation and product security. We will send one email to confirm the address, and every brief carries a one-click unsubscribe.
We use your address only to send this brief. Privacy notice.