What this roundup covers
Medical device cybersecurity moves fast. The FDA publishes new premarket and postmarket expectations, vulnerabilities are disclosed by CISA and ICS-CERT, and manufacturers learn the hard way through 510(k) holds and warning letters. This page consolidates what changed recently across four buckets: FDA and global regulatory updates, vulnerability disclosures, industry news, and analysis from the Blue Goat Cyber team.
For the day-by-day view, see today's medical device cybersecurity news in the Goat Feed.
For deeper coverage of any single topic, follow the linked pages. For a full timeline of regulatory action, see the Regulatory Tracker.
Medical device cybersecurity news to watch in 2026
Three stories drive most of this year's medical device cybersecurity news. First, the FDA issued its final premarket cybersecurity guidance on February 3, 2026, superseding the 2023 and 2025 versions. Our FDA cybersecurity guidance explainer breaks down what it requires. Second, eSTAR moved to version 7.1, the current template, which keeps all cybersecurity documents in a single attachment area (see our eSTAR 7.1 submission checklist). Third, CISA keeps adding exploited vulnerabilities that touch hospital networks and device components, which feeds straight into postmarket obligations under Section 524B.
If you only follow one thread, follow the guidance. Most FDA cybersecurity deficiency letters trace back to a gap between what the guidance asks for and what the submission shows.
The Goat's Weekly: this week's brief
Every Monday, the Goat's Weekly sums up the medical device security news that changed something for manufacturers in the last seven days, with what to do about it.
This week's FDA medical device news: recalls, adverse events and advisories
Pulled daily from FDA device recall and MAUDE adverse event records and CISA medical device advisories. Each entry links to the official record and our short summary.
- FDA recall•
FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer
(Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.
Official record - FDA recall•
FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer
(Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.
Official record - FDA recall•
FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer
(Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.
Official record - FDA recall•
FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer
(Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.
Official record - FDA recall•
FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer
(Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.
Official record - FDA recall•
FDA Recall: Life Technologies Holdings Pte Ltd, High Throughput Dna Sequence Analyzer
DNA or RNA sequencing system software has vulnerabilities.
Official record - CISA medical advisory•
InterSystems Corporation InterSystems IRIS for Health
Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device.
Official record - FDA recall•
FDA Recall: Philips Ultrasound, LLC, System, Imaging, Pulsed Doppler, Ultrasonic
Ultrasound system may: 1) Not recognize previous transducer registration, prevent scanning, require re-registration with Wi-Fi/cellular access, which may be unavailable outside of the hospital (ambulances/aircraft/field); 2) At connection between transducer USB cable to…
Official record - FDA recall•
FDA Recall: Philips North America, Monitor, Physiological, Patient(With Arrhythmia Detection Or Alarms)
Unreliable wireless roaming behavior of Smart-hopping 1.0 wireless clients during transport when connecting to Smart-hopping 2.0 infrastructure, resulting in loss of connectivity to the central monitoring system (PIC iX).
Official record - FDA MAUDE report•
MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular
Reported to the FDA Sep 7, 2026 (event Mar 24, 2026). The FDA publishes these reports weeks after receipt. Philips reviewed the reported complaint requesting ISCV design such that there is no direct connection required to database from thick client.Based on the results of the investigat
Official record - CISA medical advisory•
J4Care dcm4che
Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition.
Official record - CISA medical advisory•
Thermo Fisher Torrent Suite Software
Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.
Official record
FDA guidance and global regulatory changes
- EU Commission••Scheduled•Impact: High
EU Cyber Resilience Act becomes fully applicable
The CRA's core obligations - secure-by-design, SBOM, vulnerability handling, and 24-hour incident reporting - apply to products with digital elements placed on the EU market. Devices regulated under the MDR or IVDR are excluded.
Read the regulatory update - Red Hat••Scheduled•Impact: High
RHEL 7 Extended Life Support ends: legacy fleets need a memo
RHEL 7 ELS reaches end of support on 30 June 2026. Devices that still ship or service with RHEL 7 need a compensating-controls memo in their postmarket file.
Read the regulatory update - CISA••Active•Impact: High
CISA adds Linux netfilter flaw to KEV (CVE-2026-0511)
A use-after-free in Linux kernel netfilter (CVE-2026-0511) was added to the Known Exploited Vulnerabilities catalog, affecting many embedded Linux device platforms.
Read the regulatory update - CISA••Active•Impact: High
CISA adds widely embedded BLE pairing bypass to the KEV
CISA added a BLE pairing bypass affecting an embedded Bluetooth stack used across consumer and medical wearables to the Known Exploited Vulnerabilities catalog.
Read the regulatory update - AAMI••Draft•Impact: Medium
ANSI/AAMI SW96 Amendment 1 draft circulated for member review
Draft amendment clarifies threat modeling traceability, security risk evaluation, and the relationship between SW96 and AAMI TIR57.
Read the regulatory update - FDA••Active•Impact: High
FDA finalizes 2026 premarket cybersecurity guidance
The FDA's February 3, 2026 final guidance distinguishes nonbinding cybersecurity evidence recommendations from Section 524B statutory duties. Covered cyber-device submissions require an SBOM; VEX is optional, and an SPDF is encouraged rather than mandated.
Read the regulatory update - FDA••Withdrawn•Impact: Medium
FDA 2023 premarket cybersecurity guidance superseded
The September 2023 premarket cybersecurity guidance is superseded by the February 3, 2026 final guidance. Citing the 2023 document in new submissions is now a stale reference.
Read the regulatory update - FDA••Active•Impact: High
FDA Quality Management System Regulation (QMSR) takes effect
The QMSR formally aligns 21 CFR Part 820 with ISO 13485:2016. Cybersecurity design controls, risk management, and supplier controls must now be documented under the harmonized framework.
Read the regulatory update
From Blue Goat Cyber
Blue Goat Cyber Brings Global Medical Device Cybersecurity Expertise to SWITCH Singapore 2025
Blue Goat Cyber, the global authority in medical device cybersecurity and regulatory compliance, will attend the Singapore Week of Innovation and…
Read the full updateBlue Goat Cyber Celebrates Milestone with the Release of Its 10th Episode on the Med Device Cyber Podcast
Blue Goat Cyber, a leader in medical device cybersecurity, is thrilled to announce the release of the 10th episode of the Med Device Cyber Podcast-a…
Read the full updateBlue Goat Cyber Expands Global Presence with Strategic Success at LSI Europe 2024 and RAPS Convergence 2024
Scottsdale, Arizona, United States - October 5, 2024 Blue Goat Cyber, a leader in medical device cybersecurity solutions, is excited to announce its…
Read the full updateBlue Goat Cyber Expands into Asian Market at Mednovation MedTech Forum
SCOTTSDALE, AZ, UNITED STATES, October 24, 2024 Blue Goat Cyber, a leader in medical device cybersecurity, is excited to announce its participation in the…
Read the full updateBlue Goat Cyber Highlights Expertise at DeviceTalks West 2024; Christian Espinosa Shares Key Cybersecurity Insights
SANTA CLARA, CA, UNITED STATES, October 18, 2024 Blue Goat Cyber, a leader in cybersecurity solutions for the medical device industry, showcased its…
Read the full updateBlue Goat Cyber Joins MedTech World Bay Area as Gold Sponsor; Christian Espinosa to Join Regulatory Strategy Panel
Blue Goat Cyber, a leading cybersecurity consultancy for FDA-regulated medical devices, has been announced as a Gold Sponsor of MedTech World Bay Area…
Read the full update
Press coverage & expert commentary
- Facebook•Mention
What is Traditional versus Medical Device Cybersecurity ... - Facebook
- X•Mention
Accelerating your medical device to market? FDA cybersecurity ...
- Youtube•Mention
Medical Device Cybersecurity: Entry Points & Patient Safety - YouTube
- Linkedin•Mention
Christian Espinosa's Post - LinkedIn
- Youtube•Mention
Blue Goat Cyber: Medical Device Cybersecurity Showcase - YouTube
- Linkedin•Mention
From Air Force to MedTech Cybersecurity: My Journey with Blue ...
- Youtube•Mention
How Blue Goat Cyber Helps Innovators Win FDA Approval - YouTube
- Instagram•Mention
I often see MedTech companies come to Blue Goat Cyber with only ...