ICANN Addresses Technical Issue in RST v2.0 Testing Environment, Adjusts Evaluation Timeline

On 7 October 2025, the Internet Corporation for Assigned Names and Numbers (ICANN) identified a technical issue in the Operational Test and Evaluation (OT&E) environment for Registry System Testing (RST) version 2.0. Once notified, ICANN took both the OT&E and production environments offline to investigate and contain the problem.

The root cause was traced to a flaw that allowed a small number of RST users to view identifiable organizational data belonging to another user within the same testing system. This exposure was limited to organizational information, with only a single minor instance involving non-critical personal data. ICANN confirmed that the production environment was unaffected, and that the issue was contained entirely within the OT&E environment. Out of the 26 organizations using RST OT&E, 14 were impacted and have already been notified.

Resolution, Testing, and Independent Audit

Following an internal forensic review, ICANN resolved the root cause and began extensive testing to ensure that both the OT&E and production systems operate as intended. To reinforce confidence in the remediation process, ICANN also engaged an independent third-party security firm to review and validate its findings.

The organization stated that the OT&E and production environments will remain offline until at least 12 November 2025, allowing time for comprehensive testing and validation. ICANN emphasized that the focus is on security and reliability over speed, ensuring the restored systems meet the highest operational standards.

Impact on the New gTLD Program Timeline

RST v2.0 serves as the primary testing tool to assess the technical readiness of applicants in the New gTLD Program: Next Round Registry Service Provider (RSP) Evaluation Program. All RSPs seeking to participate must successfully pass this technical evaluation before moving forward. The OT&E environment functions as a sandbox where applicants can test and validate their configurations before formal assessment in production.

Originally, ICANN planned to release the initial list of successfully evaluated RSPs on 9 December 2025. However, due to the temporary system downtime, this date will be adjusted to give both ICANN and RSP applicants enough time to finalize all evaluation steps. The new announcement date will be confirmed once the environments are back online. Importantly, this shift does not affect the anticipated opening of the New gTLD Program’s Next Round, which remains scheduled for April 2026.

ICANN’s Commitment to System Integrity and Security

ICANN reaffirmed its commitment to addressing technical incidents swiftly and transparently. The organization stressed that while service restoration is a high priority, maintaining the security and trustworthiness of ICANN’s systems remains paramount.

ICANN expressed appreciation for the patience and understanding of RSP applicants during this process. The organization also encouraged users to report any potential vulnerabilities found in its systems or networks. The event has been officially logged in ICANN’s Cybersecurity Incident Log, underscoring the organization’s dedication to accountability and proactive risk management.