Inspectors walked into workplaces this week, the Compensation Fund started blocking employers for audit, and Microsoft shipped its largest patch month ever: three different ways of asking what you can produce.

Employers with outstanding Returns of Earnings are being blocked for audit, and the notice does not say what that costs you. The Compensation Fund published a final reminder on 9 September covering outstanding Returns of Earnings for 2025 and prior years, under the Compensation for Occupational Injuries and Diseases Amendment Act. It names the consequence as being blocked for audit and prints no submission deadline, no section and no penalty. Establish what the block actually stops before Monday: a COIDA registration is one of the few compliance records whose currency is checked by somebody else, usually a client, a main contractor or a tender panel, and it goes stale without anything expiring on your side. (Gov.za notices)

Labour inspectors spent this week walking into workplaces, and the department published the list of what it expects to find. A blitz campaign ran from 7 to 11 September across Mpumalanga's three districts, Nkangala, Gert Sibande and Ehlanzeni, with Basic Conditions of Employment Act and Occupational Health and Safety Act inspectors. The department asked that workplace records, policies and health and safety documentation be readily available for inspection, and named what it means by that: working hours, remuneration, leave provisions and employment contracts. Four of those five live in a payroll or scheduling system and cannot be printed on request without notice. (SAnews)

4 November is now a public holiday throughout the Republic, gazetted with under eight weeks' notice. The declaration was published on 9 September under the Public Holidays Act. It is local government election day and it falls on a Wednesday, which makes it three separate changes rather than one: the roster, the pay rate for anybody who works it, and every contract or service level agreement priced per working day in November. The third one is the expensive one and it is the one nobody re-reads. (Gov.za notices, News of the Day)

The CIPC says court documents are arriving at addresses companies left, and the duty sits on directors personally. Notice 41 of 2026, published 7 September, reports rising complaints about companies that relocated and did not update the register. Legal notices, court documents, compliance notices and regulatory correspondence keep going to the old premises. Under the Companies Act, 2008 the responsibility for keeping the record accurate rests with directors and prescribed officers. No deadline, no penalty and no effective date is stated; the notice lists consequences, the first of which is that failure may constitute non-compliance. (CIPC)

A tracking company with 2.2 million subscribers confirmed a ransomware attack, and an extortion group is threatening 500GB. Cartrack confirmed the attack and the group calling itself Direwolf is threatening to publish the data. If that supplier holds your fleet's location history, then under POPIA it is an operator and your business is still the responsible party, which means the answering is yours. Three things decide how bad the week is: the contract clause, the notification route, and whether anybody can list what the supplier actually holds. (MyBroadband)

SARS imposed definitive anti-dumping duties of up to 129.15% on windscreens. The tariff heading and the effective date were not published alongside the announcement, so the first job is establishing which of your part numbers sits under that heading before a quote goes out at the old landed cost. A duty rate in most distributors is a number somebody typed into a spreadsheet once, and 129.15% is not a rounding error on a quote you have to honour. (Freight News) Read →

National and provincial departments owed R15.5bn across 90 856 invoices unpaid for more than 30 days. That is National Treasury's figure at the end of the third quarter of 2025/26, and the Department of Public Works and Infrastructure, which is leading the infrastructure push, was among the worst offenders. For a subcontractor the working capital question is not whether you get paid. It is which document starts the thirty days, and whether your invoice run can prove the date it started. (Infrastructure News)

Microsoft released 974 security patches in a single month, the largest batch it has ever shipped. 113 were rated critical and two were privilege escalation flaws already being exploited when the patches arrived. Ars Technica counted 972 and 112, two fewer on each, and the difference changes nothing. July was 570 and August about 620. Whatever patching rhythm your business settled into, it was designed for a smaller month than this one. (Krebs on Security, Ars Technica)

Attackers reached JetBrains' own hosted service through a server it had not patched, and customers were told to rotate everything. The flaw was CVE-2026-63077 in TeamCity, rated 9.8, and it let an unauthenticated attacker run commands on the server. They reached a 2024 backup holding AWS credentials, stored files, synced source code and personal data, and defenders were told to audit connected accounts and repositories for activity since 8 August. Every integration a forty-person business runs is a credential somebody issued once and nobody wrote down. (TLDR InfoSec)

Products shown in Google's AI Mode were 21.6% more expensive than the same products in ordinary search results. An e-commerce analytics firm compared over two million listings across more than 100 000 result pages over 23 days in August, in the United States and the United Kingdom. The median price was $149 against $100, the main seller differed on 49.6% of matched products, and only 1.28% of products appearing in traditional results also appeared in AI Mode for the same query. Your search ranking says almost nothing about whether you are in the answer. (TLDR Founders)

Researchers made customer support agents issue refunds and disclose account data using nothing but email. Duplicate From headers, spoofed addresses, out of office replies and parser mismatches were enough to trigger profile changes, refunds, phishing sends and account disclosure. Hidden instructions in alternate parts of the message, text hidden with styling and attacker-controlled images all survived automated processing, and untrusted forum comments poisoned support knowledge bases. Anything you point at an inbox reads whatever the inbox is given. (TLDR InfoSec)

Switzerland is piloting alternatives to Microsoft 365 across about 3 000 workstations, and Brussels has started looking at Oracle. The Swiss pilot covers roughly 7% of the federal administrative workforce, with data sovereignty the stated driver and licensing cost contributing. Separately the European Commission has begun examining Oracle's software licensing practices, following an SAP probe that ended in binding commitments to abolish reinstatement fees and cut back-maintenance fees. When large buyers start pricing the exit, the exit gets cheaper for everybody behind them. (TLDR IT)

Half of surveyed UK technology chiefs said they are personally accountable when an AI agent gets something wrong. It rises to 62% at organisations of 500 people or more. A business of forty has no chief information officer, which removes the job title and not the accountability. Whoever signed the subscription is the answer by default, and it is worth that person knowing it before something goes out under the company's name. (TLDR IT)

OpenAI released a model built to operate software rather than answer questions about it. GPT-6 Astra launched on 7 September, aimed at longer-running work across browsers, spreadsheets, websites and desktop applications. No price, no rand figure and no South African availability were stated with the launch. Treat the capability as announced and the cost as unknown, because for a business of forty nothing changes until it appears inside the plan you already pay for, at a price you can see. (OpenAI, TLDR IT)

Meta launched an agent that can send email and make payments on your behalf, and you cannot get it here. Muse runs each agent in its own virtual machine with a supervising agent called Sentinel, and it connects to email, calendars, payments, shopping and smart home systems. It is on iOS, Android and the web in the United States only, so this is not a purchase decision in South Africa. What travels is the shape of the problem: an assistant with a payment method attached is a spending limit question before it is a productivity one. (TLDR AI, TLDR IT)

Cursor's cloud agents can now run on machines your own team owns. A worker links your infrastructure to the agent loop, pools scale with queued demand and idle machines hibernate, across AWS Lambda, Cloudflare, Modal and Vercel. Cursor says cloud agents already produce more than 60% of the pull requests it merges internally. If an agency builds your software, the useful question is no longer whether they use agents. It is whose machine your code sits on while they do. (TLDR Design)

1Password put access approvals inside Google Chat. Its SaaS Manager can now push IT and HR notifications, actions and approvals into the chat window, including adding and removing membership of Chat spaces, with managers approving without leaving the conversation. If you already run Workspace and 1Password this is free capability against the step every small business forgets, which is taking access away on somebody's last day rather than three months later. (TLDR IT)

GitGuardian pointed two agents at public credential leaks, and the number underneath is the reason to care. Its public secrets monitoring now triages every public code and container registry leak with a verdict, a risk score and visible reasoning, on by default for new workspaces. The figure behind the launch is the item: 1.27 million credentials leaked publicly last year, up 81%, with many still valid years later. Even if you never touch the product, that is how long a key survives after somebody pastes it somewhere. (TLDR IT)

Gen Digital released a free tool that blocks dangerous commands from an AI coding assistant before they run. Sage intercepts tool calls, checks link reputation, applies more than 300 local rules for risky commands and credential exposure, and runs two-tier prompt injection detection. It supports Claude Code, Cursor and VS Code among others, and it is on a public repository at no cost. If anybody in your business runs an assistant with access to a terminal, this is the cheapest control in this section. (TLDR InfoSec)

ChatGPT image generation shipped a version that is up to 50% faster. Images 2.5 brings sharper detail, better preservation of a reference image and more reliable editing. It sits inside a subscription most businesses already hold, so there is nothing to buy. The honest business use stays narrow: internal drafts, mock ups and things nobody outside sees, because a generated image made on a company account is a company document. (OpenAI, TLDR AI)

What happened. Microsoft released 974 security patches in a single month, the largest batch in the company's history. 113 were rated critical, and two privilege escalation flaws were already being exploited before the patches shipped. July was 570 and August about 620. Two independent counts differ by two on both totals, which is worth stating and does not change the shape of the month.

What it costs. Nothing, and that is the problem. No invoice arrives, so nothing forces the decision. The real cost is a maintenance window: an hour or two on a named evening, one person who stays reachable, and the work that cannot run while it happens. In a business of forty that person already has another job, and the window competes with month end every single month.

What it means for forty staff here. Four things face the internet and almost nobody updates them: the firewall, the VPN, the mail gateway and the camera recorder. Everything else on a desk patches itself if you let it, and letting it is a setting. The critical items are not spread evenly across your estate. Most of them land on machines that reboot when told, and a handful land on the one server that does not.

What blocks it locally. Not the patching. The reboot. A business with a server on the premises schedules a restart around load shedding, a five o'clock cutover and the one person who knows what has to come back up in which order, and none of that order is written down anywhere. That is why the honest answer here is a Thursday evening rather than a Sunday night: somebody has to be awake and answering the phone.

What to do about it. Name the evening, name the owner, and write down what is allowed to keep running unattended while it happens. Then write the order things come back up in, because that list is the actual asset and it currently exists only in somebody's head. Two hours a month on a fixed date beats a patching policy nobody ever scheduled.

1. Write the five records at the top of a page. Employment contracts, hours worked, leave balances, remuneration records, the health and safety file.

2. Pick one employee, and start a stopwatch. Ask for that person's last twelve months of hours worked.

3. Stop the clock when the document is printable. Not when somebody says where it is. When it is on paper or on screen, complete.

4. Write the number of minutes beside the row. Then do the other four records, same employee, same clock.

5. Circle every row over ten minutes. Those are the rows that fail on the day somebody is standing at reception.

6. Beside each circled row, write where the record actually lives. A system, a spreadsheet, a drawer, or a person.

7. Where the answer is a person, write their name. That row fails the week they are on leave. Note who else could do it.

8. Add two more rows: your COIDA registration and your CIPC registered address. Both are checked by somebody outside your business and neither tells you when it goes stale.

9. Put one review date on the whole page. Ninety days out. Then put it in the calendar of the person whose name is on it.

10. Send the page to whoever would meet the inspector at reception. A list only one person has read is a list that works only when that person is in the building.

Check where a court document would reach you today. The CIPC says legal papers, compliance notices and regulatory correspondence are being served at addresses companies moved out of, and the duty to keep the register current sits on directors and prescribed officers under the Companies Act, 2008. Nothing expires here. The field simply stops being true, and the first sign is a default judgment you never heard about.

Put the country on the customer record, and design to the shortest clock on it. Zambia and Zimbabwe give 24 hours to notify the regulator of a data breach. Kenya gives 72, or 24 where the systems count as critical infrastructure. Rwanda gives 48 and Uganda says immediately. POPIA sets no hour count at all, asks for notification as soon as reasonably possible, requires every security compromise to be reported regardless of assessed risk, and uniquely asks for the identity of the intruder if known. If you have customers in three countries, the shortest deadline is the one your escalation has to be built for.

Escalate your rate card per line, not on one inflation number. The Competition Commission's third Cost of Living Report names electricity, water, petrol, transport, healthcare and communication as the lines rising faster than the rest. Five of those six sit inside a cost per job. A clause that tracks headline inflation under-recovers on exactly the inputs the regulator has now measured, and it does so quietly, for a year at a time.

Self host the fonts on your website. A site that pulls its typefaces from a third party's servers sends every visitor's address to that third party to render a heading. A configurator moves them onto your own server in a few minutes, the page usually gets faster, and one data transfer nobody agreed to disappears. It is free and it is a Tuesday afternoon.

Write the driver into the job record. A traffic fine arrives against a registration number and a timestamp, and redirecting it needs a record that says who had that vehicle at that minute. Most businesses cannot produce one, so they pay. The fix is not a fines product. It is a field on the job card that is already open when the vehicle leaves.