The Labour Appeal Court backed an employer that documented its response to a grievance, Gemini 4 Argon's price doubles on 1 December, and a French fridge hack showed what unpatched remote controllers cost.

A resignation made before the employer's grievance process finished is not a dismissal. In Royale Energy v CCMA, the Labour Appeal Court set aside a Labour Court award of about R1.15 million. The employee resigned less than a month after lodging a grievance, while an external investigator was still working and alternative reporting lines were on offer. The Court said intolerability is judged objectively and that an employer needs a fair chance to respond. The ruling turns on the employer having acted promptly and kept a record. (Werksmans) Read →

Age cannot set the severance number, and signing for the lower sum does not waive the claim. In Bosch v PRASA, a 62-year-old with more than 44 years' service was quoted over R2 million under the voluntary severance package, then moved to early retirement at R657,906.67 because he was over 60. The Labour Court ordered PRASA to pay about R1.59 million. No board member testified to explain the age split, and the employer carried the burden of justifying it. (Werksmans) Read →

A freely signed mutual separation agreement is not a retrenchment. In WBHO Construction v Masenye, the Labour Appeal Court set aside an arbitrator and the Labour Court who had treated it as a disguised retrenchment. A grader operator who declined a transfer to the Northern Cape signed the agreement and took R181,541.75. The judgment is dated 26 February 2026 and was reported on 13 October. It protects an employer only where the record shows the agreement was voluntary. (Labour Guide, Cliffe Dekker Hofmeyr)

A supplier that keeps delivering to a company in business rescue gets paid first but has no vote. The Constitutional Court ruled unanimously on 7 October in Salungano Group v Mashwayi Projects. Only creditors that existed on the day rescue began vote on the plan; post-commencement creditors keep their repayment priority. The High Court and the SCA had reached opposite answers. Anyone with a customer in rescue now has to keep two ledgers apart from that date. (Werksmans)

Ampath confirms a cybersecurity incident, and disputes the size. The pathology provider says certain personal demographic and related administrative information was compromised. It calls the threat actor's claim of 80 million patient records overstated. That figure comes from the actor, relayed by MyBroadband, and has not been confirmed. Ampath has not said how many people are affected. (Bizcommunity, MyBroadband)

November's petrol forecast is a rise, and the forecasts disagree on the size. Early Central Energy Fund data, as read by Stuff, puts petrol 95 up R2.79 a litre, 93 up R2.69, 50ppm diesel up R1.59, 500ppm diesel up R1.45 and paraffin up R3.53. Bizcommunity has said nearly R5. The adjustment is expected on 4 November, a date implied rather than stated. Parliament's committee has adopted the R10bn fuel-stabilisation bill, but nobody says how much reaches the pump. (Stuff South Africa, Bizcommunity, BusinessTech)

A new Ivanti Connect Secure zero-day is being exploited now. It is an authentication bypass that runs commands with low effort, and Volexity has seen an attacker chain it with two other flaws to get root. If you or your IT provider runs Ivanti for remote access, ask today whether it is patched or switched off. (TLDR InfoSec)

Topgolf left VMware and says it has saved over $11.3 million. Broadcom's pricing was going to raise its VMware costs by 400 percent, so it moved 12,000 virtual machines to VergeOS. A business with a handful of servers will not save that much, but the first question is the same: price the renewal before you price the replacement. (Ars Technica) Read →

Malware-laced ads installed spyware on phones that only loaded a page. Citizen Lab says the AdFection campaign infected 45 devices at Al Jazeera in 2024 and 2025 using zero-click exploits on iOS and Android. The targets were journalists. The practical lesson for anyone is the old one: phones that are not updated are the ones that get hit. (Ars Technica) Read →

PC shipments fell more than 20 percent in the third quarter. Omdia calls it the sharpest decline since the first quarter of 2023: laptops down 20.6 percent and desktops down 23.5 percent. If a laptop refresh is on next year's budget, it is worth asking a supplier for a quote with a validity date now. (Ars Technica)

SAP customers are pushing back on cloud migration ahead of the 2027 support deadline. They want predictable licensing and continued support for hybrid and on-premises systems. If you run an older SAP system, the vendor's roadmap and your renewal date are not the same thing, so read the contract for both. (CIO, via TLDR IT)

Anthropic says small AI models could one day self-replicate across smart devices. In its test, a model copied itself to seven or eight of nine emulated Android nodes, slowly, and only on deliberately open devices. Anthropic puts the real risk at next year. The defence it names is basic hardening of connected devices and watching their bandwidth. (Ars Technica, The Register) Read →

Gemini 4 Argon, at $2 and $10 per million tokens until 30 November. It then doubles to $4 and $20 on 1 December. It is not on the free API tier, and Google lists South Africa as a supported country. The release date differs between sources (13 or 14 October). A pricing lever with a date on it: run one real job and log the cost before the price moves. (Simon Willison, TechCentral, Google)

ChatGPT's Chrome extension can now read the tabs you already have open. It sees them when you tag Chrome in the ChatGPT web or desktop app. The report does not say which plans or countries get it. For a forty-person business the risk is a staff member tagging Chrome with a banking page or a client portal open, so close those first. (The Verge) Read →

Chrome 155 fixes 37 flaws, seven of them critical. At least 15 were reported by Anthropic with Claude's help. Builds 155.0.8059.79 and .80 carry the fixes. This changes something for every business: Chrome only applies the update when it restarts, so staff who never close it are still exposed. (TLDR InfoSec)

Adobe patched an Acrobat flaw that a crafted PDF could trigger. The fix is in bulletin APSB26-141 and closes an out-of-bounds write. Supplier invoices and quotes arrive as PDFs, so any desk that opens attachments should be on the patched build. (TLDR InfoSec)

Meta released Muse Spark Open, an open-weight model that runs on Apple silicon. Meta and Apple launched it together so it runs locally on Macs. That means a job can stay on the machine, which matters under POPIA. Our sources give no model size, licence or quality figures, so treat it as something to test, not a recommendation. (TechCrunch, Hugging Face) Read →

Shopify is opening its catalog to shopper-configured AI agents, with human sign-off on every purchase. Agentic Storefronts let ChatGPT, Microsoft Copilot and Gemini find and buy products from merchants. For a Shopify store this is a new place to be found. The report does not say which countries are covered, so check before relying on it. (Forkast, via TLDR IT)

What shipped. Nothing new: attackers logged in to internet-connected controllers that let technicians administer a store's fridges remotely. They switched on the defrosters until the cabinets reached 50 degrees. Food spoiled and some electrical systems caught fire. (Ars Technica) Read →

What it cost. Ars reports millions in losses. It does not give a figure, and we will not put one in rands. (Ars Technica)

What was wrong. All three controller models, from Danfoss and from Dixell and its parent Copeland, had known critical flaws allowing remote login with administrator rights. Until recently Danfoss used a daily password generated from the date by its public firmware, so anyone who read the code could compute it on any device not recently updated. (Ars Technica)

What it means for forty staff here. A cold room, an aircon, a gate, a camera system or a generator controller often has a remote login that a supplier set up once and nobody owns. If it is reachable from the internet and not updated, it is the same position.

What blocks it locally. The supplier usually holds the credentials and the update schedule, not the business. Nothing in our sources says how many South African sites run these controllers.

What to do. Run this week's walkthrough: list every device with a remote login, and ask each supplier three questions.

1. Walk the premises with a notebook. Write down every device with a network cable or a SIM card that is not a laptop or phone.

2. Include the ones you did not install. Cold rooms, aircon, gate and door controllers, cameras, alarm panels, generators, printers.

3. Open a sheet with five columns. Device, supplier, who can log in remotely, last update date, who in the business owns it.

4. Fill the first three columns from what you know. Leave anything you do not know blank rather than guessing.

5. Email each supplier the same three questions. Is the device reachable from the internet? When was the firmware last updated? Is the remote password unique to our site?

6. Name one owner per device. A person, not a department.

7. Put a dated review in that person's calendar. Quarterly is enough.

8. Mark anything with no answer in red. Those are the ones to ask your IT provider about first.

Restart Chrome today. The update that fixes 37 flaws only takes effect on restart. Ask staff who keep it open for weeks to close it.

Acknowledge every grievance in writing within a day. Royale Energy won on a prompt, documented response: an investigator appointed and interim arrangements offered. Date every step.

Write the reason down when a severance scheme is designed. Bosch v PRASA was lost partly because no one could explain the age split. A paragraph in the scheme file is cheaper than R1.59 million.

Close banking and client portals before you tag Chrome in ChatGPT. It reads the tabs you have open. Open only what you are happy for it to see.

Log tokens and rands on every AI test run. The Gemini API reports usage with each response. A spreadsheet row per run is the only cost figure that applies to your work.