OFFLINE: SA’s Presidency website taken down as cybersecurity flaw sparks warnings across the world

The South African government is now among those affected by a cybersecurity flaw that has sparked concern and warnings across the world.

On Friday, 23 October 2026, the Presidency posted on X: “Please be advised that The Presidency website is temporarily unavailable as a precautionary measure in response to a global cybersecurity event.

“We apologise for any inconvenience caused and appreciate your patience and understanding while this work is being completed.”

PRESIDENCY WEBSITE TEMPORARILY UNAVAILABLE Please be advised that The Presidency website is temporarily unavailable as a precautionary measure in response to a global cybersecurity event. We apologise for any inconvenience caused and appreciate your patience and understanding while this work is being completed. The Presidency of the Republic of South Africa

— The Presidency 🇿🇦 (@PresidencyZA) October 23, 2026

It was not clear how long the site would be down.

When Daily Maverick tried to reach it a few hours later, it still said: “This site can’t be reached.”

In its post about the “global cybersecurity event”, the Presidency seemed to be referring to an issue that sparked worldwide alerts in the preceding days.

WordPress, the popular content management system used to build websites and blogs, was among those that issued an alert on Wednesday “due to the critical severity of the issues”.

PHP and ‘malicious cyber actors’

The US Federal Bureau of Investigation’s cyber division posted a warning on Wednesday that contained details about what happened.

“Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications,” it said.

“These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

— FBI Cyber Division (@FBICyberDiv) October 21, 2026

The FBI urged organisations to act.

“Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files,” it said.

“Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.”

‘Nearly 70% of all websites’

A Reuters report explained that PHP is a programming language that runs websites from behind the scenes.

“When a user loads a page, the server running PHP assembles the content and sends the finished ​page to the browser,” the report said.

It explained that PHP was free, open source and maintained by volunteers – this meant it was rare for site owners to directly interact with it.

“PHP runs nearly 70% of all websites whose programming language can be identified, according to ⁠web technology tracker W3Techs,” the Reuters report said.

“It is the engine behind WordPress, the software that powers about 40% of all websites ​such as blogs, small business pages, government portals, online shops and news sites.”

Governments, banks, media sites

A blog by the PHP Foundation, which describes itself as “a collective of people and organizations relying on the PHP language”, gave further insight into the impact of the cybersecurity issue.

“PHP runs a large share of the web, including government services, online stores, banks, media sites, and much of the software that businesses rely on every day,” it said.

“Yet security work on PHP itself still depends on a small group of foundation-funded developers and a little volunteer help.”

It was widely reported that AI uncovered the programming flaws that resulted in what the South African government termed the “cybersecurity event”.

The PHP Foundation blog said that a security firm, Calif, began an audit of PHP at the end of July this year.

On 11 August, a Calif researcher “reported an unconditional remote code execution with the same root cause” of another problem that was picked up in 2024.

OpenAI had reported the same root cause “followed by further attack vectors” that cybersecurity company Wiz also spotted.

The PHP Foundation’s security team had worked to fix the problems.

On Tuesday this week, on its X account, it alerted followers to an “upcoming security release”.

Global warnings

The following day, the UK’s National Cyber Security Centre also posted an alert headed “Critical security issue affecting PHP”.

It warned: “The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption.

“Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.”

ALERT 🚨 PUBLIC CYBERSECURITY ALERT: CRITICAL PHP VULNERABILITIES https://t.co/ZpHsfyw3ZR

— Cyber Security Authority Ghana (@CSAGhana) October 22, 2026

Ghana’s Cyber Security Authority and its National Information Technology Agency on Friday jointly alerted government institutions, website owners, businesses and hosting providers to the PHP issue.

The alert said that PHP vulnerabilities “could allow attackers to take control of affected servers without a username or password”.

It added: “Successful exploitation could expose sensitive information, disrupt services, and enable further attacks against an organisation’s network.” DM