Lamplight is now fully updated and secure from this vulnerability, as of 06.50am BST this morning, 22/10/2026, with updates that fully resolve the disclosed bugs. Lamplight is online and we expect no further disruption. We’re really very sorry for the difficulty, and any impact on your services. This was a last resort to ensure the security of your data. You can read more about what happened and how our response below.

What Happened and What We Did

According to reports, the vulnerabilities were discovered over the summer and fixes developed. These were non-trivial to resolve and took time to develop in test. This was done in secret, by the maintainers of php in conjunction with a group of large companies (AWS, Microsoft, Cloudflare etc)  that would need to deploy the patches once ready. (Lamplight, who is more of an end user in this situation) A co-ordinated announcement and update strategy had been agreed, for the 22/10/2026, so that updates could be relatively smoothly deployed.

Unfortunately, one of the companies effectively leaked the news early. This gave attackers a head start, and the defenders weren’t quite ready. Combined with the severity of the bugs, this lead to the NCSC advice to take things offline until patches were ready, and major sites across the internet closing down.

Frustratingly, we didn’t know any of this yesterday (21/10/2026). The initial announcement (a “get ready something big’s happening” type message) came without clarity about what the vulnerabilities were or what interim mitigations might be available, or when updates would be available to us. Presumably this was because everyone was caught on the hop by the leak.

When the initial announcement was made, we triggered our internal processes and mobilised the team. The technical team made what preparations they could, and turned off non-essential servers. The communications team started to prepare to be able to let customers know, once it became clearer what the situation was. Between 1:30pm and 2pm BST we added a notification within Lamplight (under the bell), sent out a Mailchimp update, and added messages on our website and social media.

When updates are released to things like php, they are not generally applied directly. They are most often sort-of included with the operating system. That means the updates to php effectively have to be included in an update to the operating system and then tested – we can’t just apply them directly. So there’s a delay between the php release to when it becomes available – in our case waiting for Amazon Linux to include the patches.

Once the main announcement was made at around 3pm BST we realised that Amazon Linux patches were not available. Instead, we updated our servers to apply temporary changes that reduced the risk, according to the advisory. The first server update was at 15:01:58.BST

We also looked at whether other precautionary protections could be put in place and implemented a monitoring to watch for any indication that our servers were being attacked. We also implemented a rolling server replacement through the afternoon.

As the afternoon continued and there was a little more clarity about the situation, the Lamplight senior team continued to meet, assess the risk and options, and decided at about 4:30pm BST that while the mitigations in place were effective, and our monitoring showed nothing out of the ordinary, they didn’t offer complete protection. At this stage there was no indication of when an update from Amazon would be available. We decided that in the circumstances we should take the unprecedented step of turning Lamplight off completely at 6pm BST (the first time in 22 years!).

We did all we could to communicate this, including Mailchimp emails to all subscribers, contacting customers directly, and updating social media.

We continued to work through the evening to be able to deploy alternative servers in the morning using the latest php version, while there was still no indication of timelines from Amazon. At 5am BST on 22/10/2026 Amazon released an updated version, and at 6am BST we started deploying and testing this, with full availability of Lamplight from 6:52am BST.

As part of our standard practice we will reflect on this incident to identify ways in which we can improve our response. If you have any thoughts on this do please let us know.

If you’re a customer of ours, we would strongly recommend signing up to our Newsletter to keep updated on all Lamplight news.

Photo by Markus Winkler on Unsplash