Trust Center

Update: ResponseSource fully restored (23 October 2026)

All ResponseSource services are back to normal. The public websites, journalist enquiries, profiles and our internal systems are working as usual, and ResponseSource emails have resumed.

What happened: On 21 October, the UK's National Cyber Security Centre (NCSC) warned of critical vulnerabilities in PHP, the software that runs a large share of the world's websites. As a precaution, we took the ResponseSource websites offline while we put extra protection in place. We have found no evidence that any ResponseSource system or data was compromised.

What we've done: ResponseSource now sits behind a different web application firewall (WAF) with better protection against the PHP vulnerability. A WAF filters malicious traffic before it can reach our servers, and our servers only accept traffic that has passed through it. We've also put the same WAF protection in front of our marketing websites. The Vuelio, Isentia and Pulsar Platforms were not affected.

This was an issue of global significance, affecting organisations around the world, and we know the downtime was disruptive. Thank you for your patience while we put safety first.

Status: ResponseSource returning online in stages

Following the NCSC alert on 21 October about critical vulnerabilities in PHP ("PHP2Shell"), we took the ResponseSource websites offline as a precaution. We are now bringing them back online behind an additional layer of protection.

What we're doing
We are moving the ResponseSource websites behind Cloudflare's Web Application Firewall (WAF). A WAF sits in front of a website and inspects every request before it reaches our servers, blocking malicious traffic. Cloudflare has released specific protection rules for this vulnerability, and our servers will only accept traffic that has passed through Cloudflare.

Most users should be able to access ResponseSource within a few hours. For a small number of users it can take up to 48 hours, depending on their internet provider or company network. During this time, some users may still see the sites as unavailable. This is expected and does not mean anything is wrong.

What this means for you

• There's no action you need to take. The sites will become available to you automatically.
• If ResponseSource still isn't available, try again later. You can also try a different network (e.g. mobile data instead of office Wi-Fi).
• ResponseSource emails will resume once the sites are fully back online.

Status: Under investigation; ResponseSource temporarily offline

Summary

On 21 October 2026, the UK National Cyber Security Centre (NCSC) issued an alert about two critical vulnerabilities in PHP, known as "PHP2Shell". PHP is a widely used programming language that runs many websites and web applications. If exploited, the vulnerabilities could allow an attacker to run code on an affected web server.

What we've done

• We have reviewed our products for use of PHP.
• As a precaution, and in line with NCSC guidance, we have temporarily taken the ResponseSource websites offline while we apply additional protections. ResponseSource emails are paused during this time.
• We are monitoring our systems closely and investigating as a priority.

Product status

• ResponseSource: temporarily offline as a precaution
• Vuelio: not affected, operating normally
• Pulsar Platform: not affected, operating normally
• Isentia: not affected, operating normally

Do customers need to take any action?

No action is needed from customers at this time. If we find that any customer data has been affected, we will contact affected customers directly in line with our contractual and legal obligations.

Pulsar Platform has completed its assessment under Microsoft’s Supplier Security and Privacy Assurance (SSPA) program.
Achieving compliant ("Green") status validates that Pulsar Platform meets Microsoft’s rigorous Supplier Data Protection Requirements (DPR). This milestone underscores our commitment to protecting enterprise data, preserving user privacy, and adhering to strict technical security controls.

What this means for our customers and partners:

• Proven Data Protection: Independent verification that our systems uphold enterprise-grade standards for handling personal and confidential information.
• Continuous Compliance: Alignment with global data governance, privacy regulations, and risk management practices.
• Enterprise Readiness: Streamlined vendor security reviews for organisations partnering with or operating within the Microsoft ecosystem.

We are incredibly proud to announce that Pulsar Group has successfully achieved recertification for ISO/IEC 27001, while simultaneously earning our first-ever certifications for ISO/IEC 27017 (Cloud Security) and ISO/IEC 27018 (Cloud Privacy).

This achievement marks a significant milestone in the security journey we began five years ago. What started as a foundational commitment to information security has matured into a comprehensive governance framework where advanced security controls are seamlessly integrated throughout every layer of our business, operations, and product suites.

Earning these additional cloud-specific certifications independently verifies that Pulsar Group is meeting the highest international standards of best practice. ISO 27017 and ISO 27018 validate that our cloud-native environments and the personal data (PII) entrusted to us by our clients are protected by world-class, rigorous controls.

An achievement of this scale does not happen overnight. It is the culmination of an immense amount of hard work, cross-functional collaboration, and dedication. We want to dedicate this milestone to all of our incredible teams around the world who made this possible. Their daily commitment to maintaining a culture of security is what allows us to continuously protect our clients and build platforms you can trust.

Cyber Essentials Plus is the highest level of certification under the UK Government-backed scheme and includes independent, hands-on technical testing to verify that our security controls are in place and operating effectively across our systems.

This recertification reflects our continued investment in cybersecurity and our commitment to maintaining strong, independently validated protections against common threats such as malware, phishing, and unauthorised access. It provides our customers with a higher level of assurance that we are proactively managing risk and safeguarding the data entrusted to us.

Pulsar Group (including Vuelio, Isentia, Pulsar and ResponseSource) has successfully completed its ISO 9001 recertification, confirming our continued alignment with internationally recognised best practices for quality management.

This certification demonstrates our customer-first approach, ensuring that our products and services are delivered consistently, reliably and with a strong focus on continuous improvement. ISO 9001 also requires robust governance, including clearly defined processes, performance monitoring, and regular reviews of controls to identify and address risks and inefficiencies.

Maintaining ISO 9001 helps us:

• Monitor and improve the effectiveness of our operational controls
• Drive continual improvement across our teams and services
• Ensure accountability and consistency in how we meet customer and regulatory expectations

This recertification reinforces our ongoing commitment to quality, transparency and trust across everything we do.