The Presidency's website is offline.
Here is what we know.

Was South Africa's Presidency website hacked? That has not been confirmed. On 23 October 2026 the Presidency said its website was "temporarily unavailable as a precautionary measure in response to a global cybersecurity event." It did not say it had been breached. The event is a pair of critical flaws in PHP, the software that runs a large share of the world's websites, and attackers are already using them.

A site taken offline as a precaution

On Friday 23 October the Presidency posted on X that its website was down while it responded to a global cybersecurity event. A few hours later, Daily Maverick reported that the site was still unreachable. The Presidency did not say how long the outage would last. Daily Maverick links the outage to the PHP flaws, but the Presidency has not confirmed that link.

It is worth being clear about what we do and do not know. Taking a site offline before it is patched is a sensible choice, and it is the kind of step the FBI and the UK's National Cyber Security Centre have advised when an update is not yet possible. It is not proof of a breach.

Two critical holes in PHP

PHP is the programming language behind a huge part of the web. It is also what WordPress runs on, and WordPress powers around four in ten websites. Two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed this week. Researchers have nicknamed them PHP2Shell.

In plain English: an attacker who can reach the server may be able to run their own commands on it, without a username or password. That can mean stolen data, defaced pages or a base for further attacks. Both flaws are rated 9.2 out of 10 for severity.

Yes. Attacks have already been seen

Security firm watchTowr reported seeing attackers use both flaws on 21 October, the day patches were released. New Zealand's cyber security centre says it is aware of reports of active exploitation. BleepingComputer reports that Cloudflare's CTO said the company saw early attacks even before the patches shipped. VirusTotal estimates more than five million PHP hosts are exposed online.

None of that means your website has been attacked. It does mean that if your site runs on an unpatched version of PHP, you are in a race.

Check your PHP version, then update

If your website is built on WordPress, or any other PHP system, the PHP version is controlled by your hosting provider or your developer. Ask them today which version your site runs and whether it has been updated. These are the fixed versions:

After the update, the workers that run PHP need to be restarted, so ask your host to confirm that has happened. If you cannot update straight away, the FBI and NCSC advice is to limit access to the site, or take it offline until it is patched. If you think your site may already have been touched, keep your logs and do not delete anything before someone has looked at it.

Assume one day a server will be taken over

Patches protect you against a flaw that has a name. The next flaw may not have one yet. So the useful question is not only "are we updated?" but "if someone did get in, what could they reach?"

That is where controlling who can see what matters. When customer information is separated, each part of the system only reaches what it needs, and every access is recorded, a break-in has less to find and is far easier to spot. It does not stop an attack like this one. It limits the damage and helps you answer the questions afterwards.