Thobeka Dywili

SOUTH AFRICA: CYBER WEEK FROM HELL While the world patched PHP and GitLab on Oct 21, SA had its own fires to put out. @ATNSSA: SA’s air navigation provider was reportedly hit by ransomware that reached the systems behind aviation weather services. Possible data theft to IPs in China. External forensic team brought in. Ampath Labs CONFIRMED. ByteToBreach claims 80M+ patient records (Ampath says that’s overstated). IDs, addresses, medical aid numbers and payment data may be exposed. Reported to the @InforegulatorSA. Europ Assistance SA (now AZOZA) ALLEGED. “The Gentlemen” ransomware gang listed them on Oct 16. Unverified. Bootlegger: an internal vibe-coded dashboard leaked contact details for 132 stores. AI writes your app, and AI-written apps leak. php2shell [9.2]: 9,800+ SA servers run PHP, including almost all the major hosts (@Afrihost, @Xneelo, @AWS Cape Town). Unauthenticated RCE. Patch to 8.5.12/8.4.27/8.3.36/8.2.35 NOW. GitLab [10.0/10]: unauthenticated RCE on self-managed servers. Every SA dev shop running its own GitLab: update today. @Railway breach + @LiteLLM malware: if your SA startup deploys on Railway or ran pip install litellm this week, rotate all keys. Meanwhile, at the @InforegulatorSA, breach reports increased from 202 (2021/22) to 2,898 (2025/26). More than 1,200 in H1 2026 alone. Enforcement has started. POPIA says report “as soon as reasonably possible.” The hackers aren’t waiting, so neither should you. Patch. Rotate. Report. Repeat. 🇿🇦