South Africa's cyber fortnight: 18 October – 1 November 2026

In this article we summarise the main developments our Radar tracked in South Africa over the past fortnight, 18 October – 1 November 2026.

Probe flags over 4K ‘ghosts’ drawing state salaries

In South Africa, a government verification process identified over 4,300 suspicious cases of 'ghost workers' on the state payroll who are drawing salaries without working for the state. These cases were flagged as high-risk frauds involving fictitious, deceased, or unverified individuals.

Discovery ranks cybercrime as its top risk, citing frontier AI

Financial services group Discovery has moved cybercrime to the top of its risk register for the year ending June 30, 2026. The group warns that advanced AI models are accelerating attacks to the point where they could outpace its current defences.

GCIS warns of information breach

The Government Communications and Information System (GCIS) notified users of a personal information breach. The incident affected its e-recruitment system, potentially exposing applicants' identity numbers, telephone numbers, and e-mail addresses.

Regulator hits FNB with R1-million Popia fine

The South African Information Regulator fined FNB R1-million for violating the POPIA Act. The breach occurred due to a misconfigured setting in the FNB mobile app, allowing 696 customers to view home loan applications of 88 other individuals. The bank failed to adequately address or report the incident after repeated customer alerts, and also had deficiencies in other data processing areas.

PHP2Shell alarm a major cyber security wake-up call

Two critical vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were discovered, allowing remote code execution without authentication. These flaws affect a significant portion of websites globally. Details of the vulnerabilities were leaked prior to their planned disclosure and patching, leading to active exploitation attempts.

SA banks warn customers not to share logins with AI agents

South African banks, including Absa, FNB, Capitec, and Discovery Bank, have warned their customers not to share banking login details with third-party AI agents. Banks caution that customers might be held liable for financial losses incurred if credentials are shared with such AI agents. This warning follows reports of unauthorized AI agents being detected in customer accounts by US banks.

Where the reports clustered

Counted by the South African organisations named in the reports: Technology & Software, 27 reports naming 22 organisations; Finance & Insurance, 21 reports naming 25 organisations; Cybersecurity, 20 reports naming 18 organisations; Government & Regulators, 18 reports naming 20 organisations; Telecommunications, 10 reports naming 10 organisations.

How to read this

Each reported fact is documented in the linked source; text labelled CSA assessment is our inference. The items are automated triage, selected and summarised by the Radar and approved for publication by the editor.