The presidency took its website offline on Friday “as a precautionary measure in response to a global cybersecurity event”. It did so two days after the developers of the PHP programming language released emergency fixes for two critical flaws that attackers are already exploiting.
“We apologise for any inconvenience caused and appreciate your patience and understanding while this work is being completed,” the presidency said in a statement on its social media platforms. It did not name the event or say when the site would be back.
The statement does not mention PHP, but the timing points to it. An Internet Archive copy of thepresidency.gov.za from 18 October shows that the site is built on Drupal, a content management system that runs on PHP. On Friday afternoon, the presidency’s server refused connections altogether.
PHP released the fixes on Wednesday, 21 October. Both flaws can allow an attacker to run code on a web server without logging in. Before the release, the EU’s computer emergency response team, Cert-EU, told organisations that could not patch to consider taking affected sites offline. Within hours of the disclosure, Cloudflare CEO Matthew Prince said the company was seeing millions of attempts to exploit the flaws across its network.
On Friday afternoon, TechCentral used an AI tool to test more than 100 websites run by national and provincial departments, metros, regulators and state-owned companies. The presidency’s was the only one that appeared to have been taken offline recently and deliberately, although TechCentral could not establish how long some others had been unreachable.
Who has patched
Other sites are down for reasons that appear to predate the PHP flaws. The website of the National Cybersecurity Hub, which the communications department’s director-general described this month as South Africa’s national computer security incident response team, says it is “undergoing technical maintenance”. Internet Archive snapshots show the same notice at intervals since February, including on 9 October, before the PHP flaws were disclosed.
The Free State provincial government’s site has returned a “service unavailable” error since at least 26 September. Several other government sites time out or present expired security certificates.
Being online does not mean a site is safe. Some web servers disclose the PHP version they run. Of the 17 government sites that did so, five reported one of the fixed releases.
The other 12 reported older versions. Eight of those run PHP versions that the PHP project no longer supports with security updates at all. The oldest, PHP 5.4, has been unsupported since 2015.
A reported version number is not proof that a site is vulnerable. Linux distributions such as Red Hat and Ubuntu often add security fixes to older PHP builds without changing the version number, and a firewall in front of a site can block attacks. Most of the sites tested do not disclose a PHP version, and several do not use PHP at all. TechCentral is not naming the sites while the flaws are being actively exploited.
A history of breaches
Government IT infrastructure in South Africa has proved vulnerable to attack. A ransomware attack in September 2021 encrypted all the justice department’s information systems. The Information Regulator later fined the department R5-million for failing to show it had renewed lapsed antivirus licences and disciplined the officials responsible.
Transnet’s 2021 ransomware attack caused weeks of delays at the country’s ports. The South African Bureau of Standards’ systems were encrypted in a ransomware attack in November 2024. The auditor-general’s 2026 report on government cyber defences blamed outdated systems, weak password policies and an untested disaster recovery plan. In September, the state-owned bulk water utility Rand Water disclosed a cyberattack on some of its IT systems.
A spokesman for the State IT Agency, which runs IT infrastructure for many government departments, said he was soliciting a response from the relevant team regarding the presidency’s website and TechCentral will update this article once feedback has been provided. — © 2026 NewsCentral Media
