October 2026 Release Notes

28th October 2026

Advance Notice Completed

As announced in the September release, OPCS 4.10 procedure codes discontinued in 4.11 are now marked as inactive in the platform. Existing assessments continue to reference these codes, and integrations providing them continue to be accepted. Customers without procedure integration can no longer select these codes manually in the clinical portal.

Improvements

Clinical Risk Score Calculators

We've made several changes to the STOP-Bang and N+V clinical risk score calculators. This is in relation to the Field Safety Notice issued on 20/10/2026-21/10/2026 with reference INC-36.

• Unanswered questions were previously counted as "no", which could make a score lower than it should be. Scores are now only calculated in full when every question needed for them has been answered. When answers are missing, a partial score is shown instead, with the unanswered questions listed for review. The partial score counts only the answered questions, so it is a minimum: once the missing answers are added, the score can only stay the same or go up.
• Scores now use sex at birth where it is recorded, and gender only where it is not. If the sex and gender answers conflict, a partial score is shown without the sex-based point, and the answers are flagged for review.
• N+V needs a motion sickness answer for a full score, unless the patient has answered "yes" to being sick after a previous general anaesthetic. Patients who haven’t had, or aren’t sure if they’ve had, a previous general anaesthetic are not asked that question, so the motion sickness answer is required to calculate a full score for them.
• STOP-Bang now uses the patient’s age calculated from their date of birth when the questionnaire is submitted, rather than a possibly outdated cached value.

Scores are intended to support, rather than replace, clinical judgement, and should be reviewed alongside the patient's full answers before planning care.

These changes are being rolled out per customer. Account managers will be in contact with customers regarding timing.

Security

Node2Shell (CVE-2026-111497) and eMudhra (CVE-2026-111943)

We have reviewed these vulnerabilities affecting Node.js, which our products use. We upgraded the platform to patched versions on 26th October 2026. Afterwards, we checked our logs for signs of attack and found none.

Customers who have installed Ultramed integration connectors should upgrade them to the latest version. We consider the likelihood of exploitation of these connectors to be very low, and recommend the upgrade as a precaution. Ultramed will upgrade managed integrations.

We are still confirming the patch status of our subprocessors. We will update this notice when those checks conclude or if our assessment changes.

Bug Fixes

• Fixed an issue where label admin would not appear for some customers. This is a platform-wide fix. No action is required.
• Further improved the reliability of queue workers, following up on the message sending delays from recent incidents. This is a platform-wide change. No action is required.