The presidency took its website offline on Friday “as a precautionary measure in response to a global cybersecurity event”, TechCentral reported.
The move came two days after the makers of the PHP programming language released emergency fixes. The fixes closed two critical flaws that attackers were already using.
“We apologise for any inconvenience caused and appreciate your patience and understanding while this work is being completed,” the presidency said on its social media platforms.
The presidency did not name the event. It also did not say when the site would return.
The statement did not mention PHP, but TechCentral said the timing points to it. An Internet Archive copy from 18 October shows the site is built on Drupal, which runs on PHP.
On Friday afternoon, the presidency’s server refused all connections, TechCentral said.
PHP released the fixes on Wednesday, 21 October. Both flaws can let an attacker run code on a web server without logging in.
Before the fixes came out, the EU’s computer emergency response team, Cert-EU, gave a warning. It told groups that could not patch to think about taking affected sites offline.
Cloudflare CEO Matthew Prince said the company was seeing millions of attempts to exploit the flaws across its network within hours.
TechCentral said it used an AI tool on Friday to test more than 100 government websites. These included national and provincial departments, metros, regulators and state-owned companies.
The presidency’s site was the only one that seemed to have been taken offline on purpose after the flaws were disclosed, the publication said.
Other sites appear to have been down since before the PHP flaws. The National Cybersecurity Hub website has shown a “technical maintenance” notice at times since February, archive records show.
The Free State provincial government’s site has returned a “service unavailable” error since at least 26 September. Several other government sites time out or show expired security certificates.
Some web servers show which PHP version they run. Of the 17 government sites that did this, five reported one of the fixed releases, TechCentral said.
The other 12 reported older versions. Eight of those run PHP versions that no longer get any security updates. The oldest, PHP 5.4, has been unsupported since 2015.
TechCentral said a version number alone does not prove a site is at risk. Some Linux systems add security fixes to older PHP builds without changing the number. A firewall can also block attacks.
The publication said it was not naming the sites while the flaws are being actively exploited.
Government systems in South Africa have been hit before. A ransomware attack in September 2021 locked all of the justice department’s information systems.
The Information Regulator later fined the department R5-million. It failed to show it had renewed lapsed antivirus licences.
Transnet’s 2021 ransomware attack caused weeks of delays at the country’s ports. The South African Bureau of Standards was hit by ransomware in November 2024. In September, Rand Water disclosed a cyberattack on some of its IT systems.
A spokesman for the State IT Agency, which runs IT systems for many departments, said he was seeking a response from the relevant team about the presidency’s website.
Source: this article is based on reporting by TechCentral. Image: TechCentral. Written with the help of AI and published by the Tzaneen Voice Technology desk. See our Editorial Standards.
Werner Jacobs covers technology for Tzaneen Voice. Werner reports on mobile networks, data prices, internet access, smartphones, apps, AI, cybersecurity and South African tech companies. Each story explains what a new product, price change or policy means for ordinary users in South Africa.