Healthcare cyber intelligence
Evidence-grounded reporting on vulnerabilities, threats, enforcement, guidance, and incidents with a concrete connection to healthcare operations.
A code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) could allow unauthenticated remote code execution, posing a risk to healthcare organizations managing mobile endpoints and ePHI.
Read the analysis →
An unauthenticated remote code execution vulnerability in FortiClient EMS could allow unauthorized access to healthcare endpoint management systems, impacting the security of ePHI environments.
Read the analysis →
A vulnerability in TrueConf Client allows for arbitrary code execution if an attacker can influence the update delivery path. Healthcare organizations using this software for telehealth should prioritize vendor mitigations…
Read the analysis →
A vulnerability in Citrix NetScaler ADC and Gateway could allow memory overreads when configured as a SAML Identity Provider, potentially impacting the confidentiality of data passing through healthcare remote access…
Read the analysis →
A stack-based buffer overflow in F5 BIG-IP APM could allow remote code execution, posing a risk to healthcare organizations utilizing the platform for secure remote access and ePHI environment segmentation.
Read the analysis →
CISA has added a vulnerability affecting multiple Apple operating systems to its Known Exploited Vulnerabilities catalog, highlighting risks for healthcare providers using these devices for clinical workflows.
Read the analysis →
A buffer overflow vulnerability affecting Safari and multiple Apple operating systems could allow memory corruption through crafted web content, posing a risk to ePHI on mobile and desktop devices.
Read the analysis →
Analysis of the Iranian MOIS 'Handala Hack' operations, including a March 2026 destructive malware attack on a U.S. medical technologies firm and the associated risks to healthcare operational resilience.
Read the analysis →
Analysis of a March 2026 destructive malware attack against a U.S. medical technologies firm attributed to Iranian MOIS actors.
Read the analysis →
A critical deserialization vulnerability (CVE-2026-20131) affecting Cisco FMC and SCC allows unauthenticated remote code execution as root, with reported use in ransomware campaigns.
Read the analysis →Discuss your risks, priorities, and next steps for stronger safeguards.