Calvient completed the necessary PHP and Node.js security updates across all affected systems within minutes of the patches becoming available on October 21, 2026. The updates are complete, and no action is required from our customers.
Healthcare organizations entrust us with sensitive patient information. Protecting that information requires preparation, accountability, and the ability to respond promptly when security risks emerge. Our response to these releases reflects that commitment—and work that began well before the patches were available.
The PHP release addressed two critical vulnerabilities, each rated 9.2 out of 10 under the Common Vulnerability Scoring System. These vulnerabilities involved how PHP handles memory and internal state when processing requests. Successful exploitation could allow an attacker to execute code on an affected server without signing in. Because the flaws affected the underlying technology, applying the security updates was essential. PHP security advisory
The Node.js release addressed separate vulnerabilities, including issues with certificate validation and a compression decoder flaw that could permit remote code execution. Node.js security release
Calvient was already preparing for these releases. Our team had been tracking the situation and coordinating directly with our technology partners to ensure the necessary updates could be obtained and applied immediately upon availability.
That advance preparation enabled us to complete the updates within minutes of release.
For our customers, the response is complete. The required patches have been applied across our affected systems. There are no outstanding steps for customers to take, no updates for them to install, and no changes required to their workflows.
This work is an essential part of our responsibility as a healthcare technology partner. Customers should be able to focus on caring for patients, confident that Calvient is attending to the security and maintenance of the platform they rely on.
Security requires sustained attention. New vulnerabilities will emerge, and addressing them responsibly means preparing early, coordinating carefully, and following through. In this case, that meant being ready before release and completing the necessary updates as soon as they became available.
Our customers trust us with their data. We work every day to earn that trust.