SA Threat Brief: Week 44

What Business Owners Need to Know This Week

Week 44 (18–24 October 2026): the pressure came from outside the perimeter, and no new South African listing appeared on the aggregator. The PHP2Shell engine flaws, leaked on 20 October and patched on the 21st, gave every internet-facing PHP server a window of unauthenticated code execution; Cloudflare counted millions of exploit attempts within a day and Amazon traced the first to 17 October, four days before the patch existed. The South African response was visible in two places: Afrihost, Xneelo, 1-Grid and Absolute Hosting mitigated before the vendors published, and the Presidency switched its website off rather than guess at its patch status. The wider state estate did not look like that. The other half of the week is Rand Mutual Assurance, the COIDA insurer holding claim files for more than a million mineworkers, acknowledging a breach alert while an extortion clock runs to the first week of November. And the Information Regulator, silent on this year’s compromises, quietly published a R1 million fine against FNB for a compromise confirmed in February 2022.

The Bottom Line: TechCentral tested more than 100 state websites. Of the seventeen that announce a PHP version, twelve announce an old one and eight an unsupported one, the oldest PHP 5.4, unmaintained since 2015. A reported version is not proof of vulnerability, but a site announcing PHP 5.4 announces that nobody has owned its platform for a decade. For a board the question is whether the organisation can say, inside a day, which internet-facing systems run which engine and who owns the patch. The Presidency could answer with a decision; twelve government sites could not answer at all. The FNB instruments add the second lesson: the regulator does act on compromises, on a four-year clock, and the fine attached to nine account numbers reached through a role-classification error, not to the 88 people exposed.

The Week in Numbers

• 138 cumulative SA ransomware victims — unchanged; no new South African listing on the aggregator, and a hand search of 90 listings by The Gentlemen, Krybit, Deadlock, Qilin and n0n found nothing South African under any tag. HIGH threat level for the 27th consecutive week.
• 366 GB, ~1.6 million claim records, 593,786 files — the extortion listing against Rand Mutual Assurance, at a price of USD 95,000–98,000 and a deadline of 4 or 5 November. The volumes are the actor’s.
• 17 October — the date Amazon’s honeypots logged the first PHP2Shell exploitation attempts; a server patched on 21 October may have been entered on the 20th.
• 12 of 17 — state websites disclosing a PHP version that run an old release; eight of them unsupported.
• 9,800+ South African servers — with a PHP banner, per MyBroadband’s Shodan search. No South African compromise through PHP2Shell has been disclosed.
• R1,000,000 — the Information Regulator’s fine against FNB under section 105(1), ten times what it collected from the IEC and from Lancet Laboratories; plus R500,000 against Central Johannesburg TVET College for ignoring an earlier enforcement notice.
• 88 data subjects, 696 unauthorised individuals, 9 account numbers — the FNB compromise of February 2022, caused by account holders being classified as employees.
• 8 new CISA KEV additions — down from nine; three overdue at publication. PHP2Shell was still not among them at the 23 October release.
• 3,111 Plex Media Server instances — exposed in South Africa, 1,426 on the default port, against an actively exploited chain that ends in unauthenticated code execution.
• 70,000+ credentials — tied to network devices, harvested through PAN-OS CVE-2026-0257, FortiWeb CVE-2025-64446 and brute force, offered by the broker k0t per Group-IB; 3,190 FortiGates answer the internet in South Africa.
• ~200 lookalike domains — impersonating AARTO, FinesSA, NATIS and forecourt brands in a smishing campaign against motorists.

Major Incidents: Who Was Hit and How

Rand Mutual Assurance — An Alert Acknowledged, a Million Claim Files Claimed

Rand Mutual Assurance, founded 1894 and licensed under COIDA to administer workplace injury and disease claims for the mining, iron and steel industries, told MyBroadband and TechCentral on 23 October that it “has received an alert about a data breach” and that investigations are under way. Behind the alert is a leak-site listing MyBroadband attributes to Kazu: more than 366 GB, about 1.6 million records and 593,786 files, a demand of around USD 98,000, and a leak date of 4 November. MyBroadband says it reviewed samples showing identity-document copies, claim forms, X-rays, medical certificates and psychologists’ material. Two things distinguish this from the insurance listings of September and October. The data: a compensation claim file is an identity document, an employer, an injury, a medical report and a bank account in one record, and it is special personal information under POPIA with no expiry date for the person concerned. The actor: Kazu is a dormant brand, 20 listings since November 2025, eleven of them healthcare, one prior African name, a leak site reachable 15% of the last month and nothing posted since 7 September. A dormant brand reappearing against a South African insurer at a price under USD 100,000 fits an affiliate using the name as well as it fits the group. The aggregator held no RMA record. Rated PROBABLE: the company confirms an alert and a named journalist reports samples; the volumes, price and date are the actor’s.

The Presidency Goes Offline — South Africa’s PHP2Shell Week

On Friday 23 October the Presidency announced that its website was temporarily unavailable “as a precautionary measure in response to a global cybersecurity event”, naming neither the event nor PHP; the site, a Drupal installation, was back and rendering normally by Sunday. TechCentral’s test of more than 100 state sites found the Presidency’s the only one deliberately taken down, and of the seventeen that disclose a PHP version, five on a fixed release and twelve on older ones. The National Cybersecurity Hub’s own site has shown a maintenance notice since February. On the hosting side, Afrihost and Axxess patched managed and shared servers; Xneelo mitigated before the patch, then updated, says its web application firewall blocked one published exploit, and warns that pre-patch compromise cannot be excluded; 1-Grid and Absolute Hosting applied mitigations and updates. Xneelo’s caution applies to every estate: Amazon’s honeypots logged the first attempts on 17 October, and Cloudflare counted millions of attempts within a day of the patch, some trying to deploy Mirai. Check Point puts two per cent of South African organisations as affected, against four for Africa and ten globally; that is one vendor’s telemetry. The outage is CONFIRMED on the Presidency’s statement; the PHP link is TechCentral’s inference. Our standing advisory on PHP2Shell is here.

A Vibe-Coded Website Entered Through Its Own Page Source

A client of Domains.co.za built its own site with an AI coding tool instead of the registrar’s builder. Six days after launch the site was gone. By the account of the registrar’s chief executive, carried by MyBroadband, the tool had left the administrator password in the page source in plain text, readable with a browser’s developer tools: no sophisticated attack, no zero-day, the attackers “just read the password and walked in through the front door”. It belongs beside Bootlegger from W43, whose legacy dashboard delivered its data with its login page: two South African applications in two weeks that exposed their secrets to anyone who read the page. The test takes a minute and is the same for both: view the source and the network calls of every internally built or generated application before it goes live. Rated PROBABLE on a single credible source; the client is unnamed.

About 200 AARTO Lookalike Domains in a Smishing Campaign

An industry source gave MyBroadband a list of about 190 domains impersonating AARTO, FinesSA, NATIS and forecourt brands such as Engen: misspellings such as aartd-finse.autos and finesea.cc, messages threatening licence and disc blocks, a R250 same-day discount, “Final Notice” subject lines sent after hours and at weekends, and fake password-protected PDF notices unlocked with the victim’s ID or business registration number. The source attributes it to the Smishing Triad. The RTIA’s position is that it alone administers AARTO fines, that the only official site is online.aarto.gov.za, and that payment needs only the 16-digit infringement notice number and no bank details. Traffic-fine smishing is a fixture; this earns its place on scale, because 200 registered domains is infrastructure, and infrastructure is reused. For a fleet operator or any employer that pays staff fines, the control is procedural: one payment route, the 16-digit number, no links. Rated PROBABLE.

The Edge, Again — Arista’s Third Flaw, Plex, and a Credential Broker

Arista VeloCloud Orchestrator CVE-2026-114625 (CVSS 9.4) lets any authenticated user with the lowest tenant role act as the local superuser; it is the third exploited VCO flaw since July, and Arista’s own advice is now to restrict the web interface to administrative networks. The Plex Media Server chain (CVE-2026-96652, -96654, -96655 and -96656) ends in unauthenticated code execution as the Plex process, is actively exploited per Plex, and has 3,111 exposed South African instances; most are home and small-office servers, and a compromised Plex host on a home connection is a proxy node inside a South African address range and, where the owner works from that network, a foothold beside a corporate laptop. The credential angle is the one that reaches boards: Unit 42 has watched PAN-OS GlobalProtect CVE-2026-0257 exploited since June and names Qilin and INC, both with South African listings, among the groups using it to open VPN sessions past MFA; Group-IB ties the broker k0t to more than 70,000 network-device credentials harvested through that flaw, FortiWeb CVE-2025-64446 and brute force. Those credentials stay valid until rotated, so the reset matters more than the patch date.

POPIA and Regulatory

The Information Regulator’s enforcement register acquired three entries dated 23 October, its first since 10 June, with no media statement and no press coverage located by 24 October. The enforcement notice against First National Bank under section 95 records a compromise FNB confirmed on 21 February 2022: the personal information of 88 data subjects exposed to 696 unauthorised individuals, and nine account numbers accessed, because some account holders had been classified as employees and given access to home-loan applicants’ information; two customers had alerted the bank in March and May 2022 and the notice finds the weakness was not fully fixed after either. It finds five POPIA conditions contravened and directs FNB to amend its privacy notice, cut over-retained records, test its safeguards, tighten role-based access, train staff on incident reporting and report with evidence within 90 days. The companion infringement notice fines FNB R1,000,000 under section 105(1), the account-number offence the Act singles out, for the nine; the 88 people exposed carry no separate fine. A third notice fines Central Johannesburg TVET College R500,000 for failing to comply with an earlier enforcement notice. Three things matter beyond FNB. The clock: a compromise confirmed in February 2022 produced its enforcement notice in October 2026, so the absence of an instrument on this year’s cases (MIP, Cartrack, RelyComply, e-Panic, Ampath) says nothing about whether one is coming. The scope: a compromise complaint became a review of the whole processing estate. The offence: the fine attached to account numbers reached by misclassified users. Elsewhere, the IEC signed a disinformation partnership with Google, Meta, Microsoft, TikTok and Moxii Africa for the 4 November elections, and the Acting Police Minister told Parliament SAPS cybercrime capacity “is established in all 9 provinces”, without numbers. For the RMA case and any like it the clocks are unchanged: POPIA section 22 as soon as reasonably possible; 72 hours to SAPS under section 54 of the Cybercrimes Act for financial institutions; and 24 ordinary hours to the Prudential Authority or FSCA under Joint Standard 2 once an incident is classified as material.

Correction to Week 43

Week 43 did not carry The Foschini Group’s investor notice of 13 October, inside that window, disclosing a cybersecurity incident identified on 11 October at TFG London, the group’s UK business trading as Phase Eight, Hobbs and Whistles: several IT systems unavailable while stores traded, UK authorities informed, customer-data impact not yet known, and TFG Africa and TFG Australia on separate systems and unaffected. A JSE-listed South African group confirming an incident belongs in the incident list; W43’s confirmations count should read three. Rated CONFIRMED on the company’s notice. No actor has claimed it and TFG had published no update by 24 October.

Full Intelligence Report

The complete Week 44 technical report covers the Rand Mutual Assurance listing and the Kazu profile, TechCentral's survey of state websites and the hosting providers' PHP2Shell response, the FNB and TVET College enforcement instruments in full, all eight catalogue additions with fixed versions and the Plex exposure figures, the PAN-OS and FortiWeb credential-market analysis with Unit 42 and Group-IB indicators, the AARTO domain list, the TFG London correction, structured hunt missions with IOC tables and the full source list.

What Your Business Should Do Right Now

• Close the PHP2Shell question by Tuesday 27 October, and write the answer down: Inventory every internet-facing system that runs PHP, including appliances, control panels and vendor web interfaces; confirm 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the distribution’s backported package by changelog. For anything older: upgrade, take it offline or put it behind a WAF, with session.upload_progress.enabled=0, memory_limit=-1 set so applications cannot override it, and post_max_size kept low. The inventory outlives the flaw; keep it.
• Then hunt from 17 October, when exploitation began: PHP workers spawning shells or download tools, repeated HTTP 500 responses after oversized multipart requests, new files in web roots, new administrator accounts. A server patched on 21 October may have been entered on the 20th; Xneelo says so of its own estate.
• If you run a GlobalProtect portal or a FortiGate, run the credential-market checks by Wednesday 28 October: Search GlobalProtect logs for the nine Unit 42 addresses and the two spoofed host identifiers in this week’s IOC file, disable Authentication Override cookies, confirm the FortiWeb and FortiGate builds, and reset every account whose credential has appeared in a stealer log. The broker’s inventory was assembled between February and June and stays valid until rotated.
• Treat every management plane the way Arista now tells VCO customers to treat theirs, by Friday 30 October: Restrict the web interface to administrative networks, search the web log for encoded paths and the two advisory addresses, and apply 5.2.3.18, 6.1.3.10 or 6.4.2.12. The same control covers the Plex and Nextcloud entries, which are unauthenticated chains against anything that answers.
• If you administer claims, policies or scheme membership, re-run the first-48-hours plan against the RMA facts by Friday 30 October: The listing names the organisation, a volume, a price and a date, and the sample a journalist sees decides the headline. The plan needs a holding statement that says more than “an alert was received”, a decision on naming the actor, the Information Regulator record, the Prudential Authority or FSCA notification where Joint Standard 2 applies, and a call-centre briefing on claimants whose identity documents and medical records may now be in a third party’s hands.
• Add a view-source check to the release gate for every internally built or AI-generated web application: Bootlegger delivered its data with the login page; the Domains.co.za client shipped its administrator password in the page. View the source and the network calls before anything goes live.
• Export this week’s indicators to blocklists and retro-hunt 30 days: The two Qilin addresses, the Unit 42 nine, the Arista two, the Wordfence and Sophos PHP2Shell sets, the Microsoft Storm-0940 addresses and the AARTO domain patterns are in the IOC file below with their sources. If any Microsoft 365 tenant has had a ConnectWise application consented, check the three application identifiers in the file against service-principal sign-ins since 1 October; an hour per tenant.
• Table the FNB instruments at the next risk committee, with two questions: Which security compromises and complaints from 2022 to 2026 are still open with the Information Regulator, who owns each, and what would a 90-day report on them contain; and whether any customer, member or applicant data is reachable through a role-classification error of the kind the notice describes.
• Brief staff and fleet administrators on the AARTO campaign: One payment route, the 16-digit infringement notice number, never a link, and no bank details. The official site is online.aarto.gov.za.
• For the election fortnight, decide who can say within an hour whether a site outage is hostile or housekeeping: The Presidency said “precautionary measure” on the day and avoided a week of speculation; a municipality, utility or media house whose site goes down on 4 November will need the same sentence ready, and the log evidence behind it.