Backdoor found in two healthcare patient monitors, linked to IP in China

**Executive summary:** CISA and the FDA report that Contec CMS8000 patient monitors contain firmware functionality that mounts a hard-coded remote NFS share, copies and overwrites binaries (enabling remote code execution), and transmits patient-identifiable data to an external IP; Claroty later suggested the behavior may be an insecure, physical-button-triggered update mechanism, but the design still poses serious security and data-exfiltration risks and no complete patch is available, so healthcare operators are advised to disconnect affected devices when possible.