Following the update to the Luscii platform. The review of Graphnet customer facing services is complete and we can confirm that no PHP vulnerabilities were present in the CareCentric shared care record, Population Health or other end user applications.
Posted Oct 22, 2026 - 10:21 BST
Update
Luscii PHP vulnerabilities have been patched and the services are back up and running.
"Luscii is back online The security update has been implemented on our systems, and Luscii is available again as usual. Thank you for your patience and understanding."
This incident is now marked as operational.
We are currently awaiting confirmation that no Graphnet systems use the impacted software and will resolve this incident once the review is complete.
Posted Oct 21, 2026 - 21:51 BST
Investigating
For information only, CareCentric is fully operational, however this is to make you aware of an issue at a partner organisation.
"Due to a newly disclosed PHP vulnerability, Luscii has taken its services offline as a precaution. We have no reason to believe there has been unauthorized access to systems. A security update from PHP is expected shortly. As soon as it's released, we'll apply it and bring our services back online. We'll let you know as soon as Luscii is available again."