We are closing access to Lamplight tonight (21st October) from 6pm (BST), until 8am (BST) tomorrow (22nd October).

As you may know from our other communications, The National Cyber Security Centre issued a global critical alert today for any websites or databases which are run on PHP, which is the underlying structure on which Lamplight runs. This is affecting websites and databases globally.

We’ve updated Lamplight this afternoon to help minimise the risk, but are reliant on AWS, our web host for a further update which will give complete protection from this vulnerability. In the meantime we are continually monitoring our systems and carrying out other precautionary actions. Given that Lamplight will remain vulnerable until we are able to install the AWS update, we have made the difficult decision to shutdown Lamplight overnight, from 6pm today (21/10/2026) to 8am tomorrow (22/10/2026). You may have seen on the news that others are also doing this, around the world, including councils, governments and the BBC. (Websites taken down worldwide as critical PHP cyber-security update issued – BBC News)

We understand the difficulty this will cause for those of you using Lamplight overnight, and can only apologise that this is necessary. We would not do this unless we believed it was essential for the safety and security of your data.

Because PHP is so widespread, we recommend that you contact whoever looks after your main website and ask them about this issue.

Further Information on the Issue

We were notified today by the National Cyber Security Centre of a major security update needed in the technology underpinning Lamplight. The issue isn’t with Lamplight but with the underlying technology it’s based on, and which most websites are based on. In other words, this is a global issue affecting millions of websites (an estimated 66% of all websites). We are not the only site shutting down as a result of this, and have worked hard to avoid this.

The National Cyber Security Centre give this a severity rating of 9.2 out of 10 (about as high as it gets), and gives clear advice to shut down if you are not able to fully update.

You can read this guidance here: Critical security issue affecting PHP | National Cyber Security Centre

Updating Lamplight

Lamplight is based on PHP, and run on AWS servers. This means the update patch, which has now been released, needs to be processed by AWS in order for us to install it. We do not know why AWS have not already released this, and are doing all we can to find out. We are also urgently exploring other options which would allow us to apply the patch without AWS. The latest updates are at https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109618.html.

In the meantime we are taking all the steps we can to protect your data. Shutting down the system overnight is taken as a last resort, and on the basis that protecting your data is more important than your data being available.

We’re very sorry. We know the impact this will cause for you, and are doing all we can.

Photo by Masaaki Komori on Unsplash