South Africa's presidency has pulled its own website. On Friday, 23 October, thepresidency.gov.za went offline, with the presidency citing "a global cybersecurity event" and calling the move a precaution, TechCentral reports. It did not name the event, mention PHP or say when the site would be back.
The timing points to PHP. On Wednesday, 21 October, the PHP project released fixes for two critical flaws that can let an attacker run code on a web server without logging in, and attackers are already exploiting them. An archived copy from 18 October shows the presidency's site runs on Drupal, which is built on PHP.
Before the fixes, the EU's CERT-EU advised organisations that could not patch to consider taking affected sites offline. Cloudflare's chief executive said the company saw millions of exploit attempts within hours of the disclosure.
The rest of government
TechCentral used an AI tool to test more than 100 government, metro, regulator and state-owned company sites. The presidency's was the only one that appeared to have been taken offline recently and on purpose.
A version number alone does not prove a site is vulnerable, TechCentral notes, because Linux distributions often backport fixes and firewalls can block attacks. It is not naming the sites while the flaws are being exploited.
The South African state has been hit before: the justice department's 2021 ransomware attack, Transnet the same year, the SABS in November 2024, and a Rand Water attack disclosed in September 2026.
