On Friday 23 October 2026, South Africa's Presidency took its website offline. TechCentral reported that the Presidency called it a precautionary measure "in response to a global cybersecurity event". The statement did not name PHP, and TechCentral says the link is its own inference: an archived copy of the site from 18 October showed it was built on Drupal, which runs on PHP. The shutdown came two days after the PHP project shipped emergency fixes for two critical flaws. A report that the FBI had warned operators to patch or pull vulnerable systems offline is carried by Business Today.
The episode is being read as a test of South Africa's legal framework. Press reports describe the Cybercrimes Act as the country's main cyber law, the South African Police Service (SAPS) as the lead investigator, and a standalone cybersecurity bill as still unfinished. I could not independently confirm the bill's status from a primary source. The sections below treat it as reported, not as verified.
The strongest case for more law
The argument for a dedicated cybersecurity statute is serious. The Cybercrimes Act 19 of 2020 is mainly a criminal-law instrument. Webber Wentzel's summary says it requires the SAPS National Commissioner to designate a "Point of Contact". It obliges electronic communications service providers and financial institutions to report a cybercrime involving their services to SAPS within 72 hours of becoming aware of it. It gives SAPS search and seizure powers.
None of that tells a government department how fast it must patch. A police-led, offence-driven regime acts after harm. A standalone law could set baseline duties, name a civilian technical authority, and require departments to report vulnerabilities and exposure. By that reasoning, a precautionary shutdown shows the state improvising without a rulebook.
What the PHP episode shows
The facts point to an operational problem, not a legislative one. The PHP project's 21 October advisory describes two flaws, CVE-2026-109618 and CVE-2026-109619, that "can allow unauthenticated remote code execution". Its 20 October pre-announcement rated both CVSS v4.0 9.2. The advisory says they affect "all PHP installations serving web requests", including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older receive no project updates.
Against that, a Presidency that removed its site within roughly 48 hours made a defensible call. Business Today reports the FBI's guidance as patching immediately or, if that is not feasible, taking the affected system offline until mitigation is complete. Pulling the site was a reasonable response to that guidance. For a flaw this severe, the better outcome is a patched site that stays online. The cost of the outage was a public-facing page that went dark, not a confirmed breach. The coverage I could verify does not say any data was compromised, and the Presidency has not said when the site will return.
Where a statute would and would not help
A new cybersecurity bill is useful only if it targets the failure points this episode exposes:
- Asset inventory. Departments cannot patch what they have not catalogued. The reporting suggests the technology stack was identified by outsiders from archived pages.
- Vulnerability communication. The Presidency's notice named no cause and no restoration date. A short, factual disclosure norm would cost little.
- Hosting and maintenance responsibility. TechCentral says the State IT Agency was approached for comment. Clear ownership of who patches which system matters more than another offence.
What the bill should avoid is expanding SAPS discretion or adding licensing, registration or broad takedown powers for private operators. The Cybercrimes Act already contains a 72-hour reporting duty and warrantless search powers in some circumstances. Piling mandatory obligations on private firms does not make a government website patch faster. Compliance-heavy regimes tend to reward paperwork over speed, and a small hosting provider or startup has less capacity to absorb it than a large incumbent.
A proportionate approach
Three steps would address the gap without enlarging the criminal-law footprint.
- Binding patch-timelines for government systems. Critical, remotely exploitable flaws on public-facing government sites should carry a short, published remediation window. The standard should apply to the state before it applies to the private sector.
- A civilian technical lead. Keep the SAPS role focused on investigation and prosecution. Put coordination, advisories and incident triage in a technical body that can publish warnings quickly.
- Voluntary, safe-harbour disclosure for private operators. Encourage reporting and information-sharing with liability protections, instead of widening mandatory duties.
The Presidency's response is a data point for patching speed, not proof that the law is failing. The next piece of legislation should be judged by one test: would it have made the government site patch faster, disclose sooner, or recover better? Powers that only strengthen the police after an incident do none of that, and they carry real costs for speech, privacy and small operators.
What to watch
Three things will show whether South Africa's response is proportionate: whether the Presidency publishes a post-incident account, whether the cybersecurity bill is aimed at state systems before private ones, and whether SAPS's role stays investigative. The PHP flaws will not be the last of their kind, and the useful lesson is how quickly a state can find, patch and explain.