IDDQD
Trust centre

All updates

Certifications, audits and responses to major vulnerabilities.

  1. Certification

    Cyber Essentials certified

    IDDQD holds Cyber Essentials, the UK government-backed scheme for baseline cyber security, alongside its ISO/IEC 27001:2022 certification.

    Read the announcement
  2. IST-122
    Security advisory

    Node.js October 2026 security release, including Brotli flaw CVE-2026-111497

    Closed out

    Node.js fixed 10 vulnerabilities on 21 October. The Node.js project says the most serious, in the Brotli decoder, allows remote code execution. The fix was deployed two days after release.

    Opened
    23 Oct 2026 - closed 23 Oct 2026
    Findings
    Exposure on incoming requests was low, because the API does not decode Brotli. Outgoing connections could still be affected, so the fix was applied regardless. No evidence of exploitation was found.
    Actions taken
    Affected production services were rebuilt on the fixed Node.js release, verified and redeployed.
  3. IST-121
    Security advisory

    PHP2Shell: critical PHP remote code execution (CVE-2026-109618, CVE-2026-109619)

    Closed out

    A critical flaw allows unauthenticated remote code execution through any web-facing PHP runtime. No exposure was found in IDDQD services.

    Opened
    21 Oct 2026 - closed 30 Oct 2026
    Findings
    No PHP runtime serving web traffic was found on the systems examined, so the attack path is absent. The same assessment covers the related CVE-2026-115560. No evidence of compromise was found at monitored suppliers, and no breach notification was received.
    Actions taken
    Servers, container clusters and web server configuration were examined for PHP. Key suppliers were monitored from 22 to 29 October. The issue was closed as not applicable.
  4. Audit

    Passed the 2026 ISO/IEC 27001 audit

    An independent audit confirmed IDDQD's ISO/IEC 27001:2022 certification for another year, covering every service in the group.

    Read the announcement
  5. IST-81
    Security advisory

    React Server Components remote code execution (CVE-2025-55182)

    Closed out

    A critical flaw, rated CVSS 10, allows remote code execution through React Server Components and Next.js. One IDDQD website ran an affected version, but the flaw could not be exploited there. The website was patched within two days of disclosure.

    Opened
    04 Dec 2025 - closed 05 Dec 2025
    Findings
    One public website ran an affected version, but the flaw could not be exploited there. The other websites assessed were not exposed, as they ran unaffected versions or did not use server components.
    Actions taken
    IDDQD websites and documentation sites were assessed. The website on the affected version was patched and the issue was closed on 5 December 2025.
  6. Certification

    ISO/IEC 27001:2022 certificate issued

    Centre for Assessment Ltd issued certificate 21/0344, valid until 18 January 2028.