AI news for South Africa, 22 October 2026
Today's brief is dominated by two things an SA operator cannot ignore: a critical PHP vulnerability found by AI that has already been exploited in the wild and affects the majority of the web, including WordPress, Drupal, Joomla and Magento sites, and new research showing 92% of Africa's ransomware detections are in South Africa while only 40% of security leaders have a strategy for AI-driven attacks. On the money side, DeepSeek closed a $15 billion round and Meta is issuing a new class of shares to fund AI, both of which point to cheaper, more capable open models and more aggressive agentic commerce reaching SA users through WhatsApp and Facebook.
-
AI-found PHP flaw takes down government sites, 1.5 million hosts still unpatched
Developers of the PHP programming language released urgent fixes on Wednesday for critical vulnerabilities that had been hidden in the codebase for more than a decade, discovered using AI by security firms Calif and Wiz. Government agencies across Europe took sites offline as a precaution, and Censys data shows about 1.5 million of 2.6 million hosts run a version of PHP with no fix. Amazon said it detected an exploitation attempt against a honeypot system on 17 October, four days before public disclosure, and the flaws are now being broadly exploited.
For a South African business: If your business website runs WordPress, Drupal, Joomla or Magento, it almost certainly runs PHP and is exposed right now. Get your host or developer to patch immediately or take the site offline, because AI has made reverse-engineering this bug cheap for attackers and SA already carries the bulk of Africa's ransomware detections.
-
92% of Africa's ransomware detections are in South Africa, and agentic AI is speeding up attacks
In a TCS+ interview, Arctic Wolf's Jason Oehley and Andre Den Hond said an Interpol report found 92% of ransomware detections on the continent are in South Africa, driven by high connectivity, a large financial services sector and a big mid-market. They said agentic AI systems can automate the attack chain, adapt when an exploit fails and never tire, putting SMEs squarely in the crosshairs, and that the time between a vulnerability being identified and exploited has collapsed.
For a South African business: A Johannesburg accounting firm or Takealot seller with no dedicated security team is now a viable target because AI removes the manual effort attackers used to need. Budget for basic patching, backups and monitoring before you spend on AI tools, and check whether your cyber insurance actually covers data theft rather than just encryption.
-
69% of security leaders expect AI-driven attacks, only 40% have a plan
ITWeb reports research showing a 29-point gap between the 69% of security leaders who expect AI-driven attacks within 12 months and the 40% who have a specific strategy to address them. The same white paper found 98% of organisations have unsanctioned AI tools active in the environment, 47% use personal GenAI accounts for work data, and only 18.5% of employees know their organisation's AI use policy.
For a South African business: If your staff are pasting client data into personal ChatGPT accounts on work laptops, you already have the exposure the research describes, and POPIA makes you the responsible party when that data leaks. Write a one-page AI use policy this week and check which AI tools are already running on your network.
-
DeepSeek raises $15 billion, with CATL and Tencent backing a Shanghai IPO plan
Ventureburn reports DeepSeek raised about $15 billion (roughly 100 billion yuan) in a round backed by battery maker CATL and Tencent, after starting with a 50 billion yuan target that demand pushed higher twice. Dealroom puts the pre-money valuation at around $68.8 billion, and combined with a June round of more than $6.88 billion the company has raised roughly $20.6 billion in six months, with a Shanghai Star Market IPO reportedly in the works. The report has not been officially confirmed by DeepSeek.
For a South African business: DeepSeek's open models are free to download and run, and more capital pointed at open-source work usually means stronger and cheaper models that SA developers can self-host without paying dollar-denominated API fees. If you are building on a paid US model, keep a DeepSeek or other open option on your roadmap as a cost hedge against the rand.
-
Meta issues a new class of shares to fund AI, as Muse passes 10 million users
Meta said in its Q3 earnings that it will issue a new class of non-voting shares to fund AI initiatives, acquisitions and employee compensation, with trading starting in 2027, and it now expects capital expenditure of $135 billion to $145 billion this year. On the same call, CEO Mark Zuckerberg said the Muse AI agent has passed 10 million users, about 25% of those who set it up use it daily, and over a quarter of engaged shopping users had an average purchase size above $200. Meta also paused Muse's conversation-sharing feature after researchers found chats publicly available on the web.
For a South African business: Muse is the AI layer Meta is pushing into Facebook, Instagram and WhatsApp, which is where most SA businesses already talk to customers, so agentic shopping and agent-to-agent buying is heading for your WhatsApp Business number whether you plan for it or not. The privacy pause is the warning: do not let customer conversations flow into a feature you have not checked against POPIA.
-
Anthropic launches Claude Duet agent for small business, but waitlist is US-only
Anthropic announced Claude Duet, an AI agent built on Claude Opus 5.5 and aimed at professionals and small business owners, launching as a research preview as a standalone iOS and Android app and through Claude on the web. It sends a morning brief across connected apps, monitors them through the day, and can take on tasks from scheduling to building dashboards and web apps, asking for approval before big steps like sending a payment. Anthropic says it is an early version that may misread threads, and the waitlist requires a Pro or Max subscription in the US.
For a South African business: This is exactly the kind of tool a small SA law firm or accountancy practice would use to chase SARS deadlines and client emails, but it is not available here yet, so do not build a workflow around it. Watch for the waitlist opening beyond the US, and note that any agent with access to client files raises the same POPIA questions as giving a staff member the keys.
-
Recursive releases Flint, a free coding model that runs on a laptop offline
Recursive released Flint, a free coding model that runs locally on a laptop and was built largely with the help of its own Eureka Machine automated research system in under four months. Flint is a mixture-of-experts model using 2.5 billion of its 40 billion parameters at a time, is downloadable on Hugging Face under the Apache 2.0 licence, and in Recursive's tests generated about 131 tokens per second on a MacBook Pro with an M4 Pro chip. It outperformed other models under 50 billion parameters on SWE-Bench Verified, though Recursive says it needs more guidance than paid assistants.
For a South African business: A free model that runs offline on a laptop means a SA developer can keep client code private and pay nothing in dollar-denominated API fees, which matters when load-shedding or a dead fibre line kills your cloud connection. It is not a replacement for Claude Code or Codex on complex work, but it is a genuine option for small teams watching the exchange rate.
-
Luminate CEO warns Africa against confusing data centres on its soil with owning its digital future
At the Build 2026 Conference in Abuja, Luminate CEO Melanie Hui said Africa risks a subordinate role in the global AI economy unless it secures genuine ownership of the infrastructure, and warned against confusing data centre hosting with sovereign control. She cited research showing undersea fibre cables carrying Africa's internet traffic mirror historical trade and extraction routes, and noted that despite hosting a third of the world's languages, AI platforms remain largely tone-deaf to African linguistic diversity.
For a South African business: This is the policy backdrop to the data residency questions SA businesses are already being asked under POPIA, and it is the argument behind local hosting and local language support. For now it changes nothing about your tooling, but it is worth knowing when a vendor claims a local data centre makes them POPIA-compliant.