The presidential website was taken offline on Friday 'as a preventive measure in response to a global cybersecurity event.' This occurred two days after PHP programming language developers released emergency patches for two critical vulnerabilities that are already being actively exploited by attackers.
In a statement posted on social media, the presidency apologized for any inconvenience and thanked people for their patience, but did not name the event or state when the site would be restored. Although the statement does not mention PHP, the timeline suggests this connection. The Internet Archive shows that presidency.gov.za is built on Drupal, a content management system that runs on PHP.
On Friday afternoon, the presidential server completely stopped responding to connections. The PHP patches were released on Wednesday, October 21. Both vulnerabilities potentially allow an attacker to execute code on the web server without authorization. Before the patches were released, the EU Computer Emergency Response Team, Cert-EU, warned organizations that could not install patches to consider taking down affected websites.
Within hours of the disclosure, Cloudflare CEO Matthew Prince reported that his network was detecting millions of attempts to exploit these vulnerabilities. On Friday afternoon, the publication TechCentral used an artificial intelligence tool to scan over 100 websites belonging to national and provincial departments, metropolises, regulators, and state-owned companies. The presidential website was the only one recently and intentionally taken down, although TechCentral could not determine how long other sites had been unavailable.
Who installed the patches
Other websites are down for reasons that appear to predate the PHP vulnerabilities. The National Cyber Security Centre, whose director of communications called itself South Africa's national cyber incident response centre, reports that it is 'undergoing maintenance.' Snapshots from the Internet Archive show the same notification dating back to February, including October 9, prior to the PHP vulnerabilities being disclosed.
The Free State provincial government website has been in a 'service unavailable' error mode since at least September 26. Several other government websites are either frozen or displaying outdated security certificates. However, having a site online does not guarantee its security, as some web servers reveal the PHP version in use. Of the 17 government sites checked, five reported one of the patched versions, while the remaining 12 used older versions. Eight of these sites run on PHP versions that the PHP project no longer supports for security updates; the oldest version, PHP 5.4, has not been supported since 2015.
The reported version number is not proof of vulnerability, as Linux distributions like Red Hat and Ubuntu often add security fixes to older PHP builds without changing the version number, and a firewall in front of the site can block attacks. Most tested sites do not disclose the PHP version, and some do not use PHP at all. TechCentral refrains from naming the sites while the vulnerabilities are actively being exploited.
History of hacks
South Africa's government IT infrastructure has repeatedly shown vulnerability to attacks. In September 2021, a ransomware attack encrypted all information systems of the Ministry of Justice. Later, the Information Regulator fined the ministry 5 million rand for failing to provide evidence of renewed expired antivirus software licenses and held responsible officials accountable.
A ransomware attack on Transnet in 2021 led to weeks of delays at the country's ports. Systems of the South African Bureau of Standards were encrypted in a ransomware attack in November 2024. The 2026 Auditor-General's report on government cybersecurity noted outdated systems, weak password policies, and an unverified disaster recovery plan.
In September, the state water utility Rand Water reported a cyberattack on part of its IT systems.
A representative from the State IT Agency, which manages the IT infrastructure of many government departments, stated that they had requested a response from the relevant team regarding the presidential website, and TechCentral would update the article upon receiving feedback.
