This explainer is for Nigerian business owners, web developers, IT managers and public institutions who depend on a local web host or a .ng domain registrar. It looks at why trust in parts of the market remains fragile, what the evidence shows, what sits behind the problems, and what customers, providers and regulators can do about it.

Key takeaways

• The .ng namespace is growing but remains small: about 249,897 domains were under management at the end of July 2026, far below the one million target NiRA set in 2019.
• Avoidable domain deletions have been eating into growth. For the first five months of 2026, deletions were equal to more than half of new growth.
• Only 15 of 164 accredited registrars (about 9%) had DNSSEC-enabled domain management in mid-2026, a weak point for security.
• Well-publicised failures, such as sites that stayed offline after customers renewed hosting in 2025, damage confidence in the whole local market.
• High energy costs, foreign-exchange pressure and thin margins make reliable hosting expensive to deliver in Nigeria.
• New data localisation rules mean more data must live in Nigeria, which raises the stakes for getting local hosting right.

What is going wrong in the market

Not every Nigerian host or registrar is failing. Several providers run solid services, and some have invested heavily in better infrastructure. But customers keep reporting the same pattern of problems, and those problems shape how the whole sector is seen.

Downtime and slow support

The most damaging complaints are about sites going offline and support teams going quiet. In August 2025, customers of the Nigerian host HostNowNow reported that websites stopped working after they renewed their hosting. One developer said two sites he managed stayed inaccessible despite repeated contact, and a media and IT firm said it eventually moved a client’s site to another provider and even changed the domain extension. The company acknowledged “internal operational issues”, explained that some processes had moved from automated systems to manual handling, and promised refunds and apologies. Later reports said some customers did receive refunds after the complaints became public.

The pattern is familiar. Developer accounts going back years describe support tickets left unanswered for days, slow page loads and unexplained outages. Those stories travel fast in Nigeria’s developer communities and push many technical buyers towards foreign providers by default.

Lapsed and deleted domains

NiRA’s own figures point to a retention problem. Its July 2026 Registrar Ecosystem Update recorded 5,646 deletions in July, the lowest monthly figure of the year. Even so, deletions equalled almost a third of growth that month, down from 42.7% in June and above 50% in each of the first five months of 2026. NiRA describes many of these losses as avoidable. In practice, a deleted domain often means a business forgot to renew, never received a reminder, or did not control the account its domain sat in.

Weak security basics

DNSSEC protects visitors from forged DNS answers that can redirect them to fake sites. NiRA has implemented DNSSEC at the registry level, but the same July 2026 update found that only 15 of 164 accredited registrars, about 9.15%, offered DNSSEC-enabled domain management. For a country where phishing and impersonation are daily problems, that is a large gap.

Slow growth of the national namespace

In 2019, NiRA set a goal of one million active .ng registrations within five years. By mid-2026 it reported about 241,000 active domains, rising to just under 250,000 by the end of July. Growth has picked up in 2026, but the namespace is still a fraction of the target, and many Nigerian businesses and institutions continue to use foreign extensions.

Why it matters

A website is now a shop front, a payment page and a customer service desk. When it goes down, the cost is immediate.

• Lost revenue and leads: visitors who find a dead page rarely come back.
• Reputation damage: customers blame the business, not the host.
• Search ranking losses: slow or frequently unavailable sites are harder for search engines to crawl and index.
• Security exposure: expired domains can be re-registered by others, and poorly maintained servers are easy targets.
• National capacity: every customer who gives up on local providers takes spending, jobs and skills offshore.

The money involved is not trivial. As far back as 2017, NiRA’s then president estimated that hosting .ng sites abroad cost Nigeria up to N60 billion a year in lost value, and a 2013 study by Gigalayer found that more than 90% of websites owned by Nigerians were hosted outside the country. Those figures are old, but they show how long the problem has persisted.

What sits behind the problems

Energy costs

Running servers around the clock needs constant power and cooling. Grid electricity now reflects full market tariffs, diesel is no longer subsidised, and self-generated diesel power is reported to cost between US$0.28 and US$0.33 per kWh. For many Nigerian data centre operators, energy is said to account for more than 35% of operating expenses. Smaller hosts that rent space or run their own racks feel these costs most, and cutting corners on power and cooling shows up as downtime.

Heat is a real risk even for large operators. On 8 October 2026, the NCC’s incident board linked a major MTN network disruption across parts of Lagos, Oyo, Rivers, Delta and the FCT to high temperature at an MTN data centre. It is a reminder that resilient facilities need serious, well-maintained cooling and backup.

Foreign exchange and pricing pressure

Much of what hosts buy, from server hardware to software licences and international bandwidth, is priced in dollars. When the naira weakens, costs rise faster than providers can raise prices in a highly price-sensitive market. The result is often a race to the bottom: very cheap plans, overloaded shared servers and thin support teams.

Scale and skills

Many hosting firms are small businesses reselling capacity bought elsewhere. They may lack round-the-clock engineers, documented processes or automated billing and provisioning. The HostNowNow case showed how quickly service suffers when automated systems give way to manual work.

Low switching costs, low accountability

Customers who are unhappy often simply leave, frequently for a foreign provider, rather than complain formally. Without published uptime figures, independent reviews or clear service-level agreements, weak providers face little pressure to improve.

The case for change, and what is already moving

There are signs of progress. NiRA launched a new online Registrar Accreditation Platform in 2025 to make onboarding faster and more transparent, and 23 new registrars were accredited in 2024. It reports stronger retention in 2026, with combined new registrations and renewals of 17,810 in July, the highest monthly total of the year. NiRA has said it will push multi-year registrations, renewal reminders and wider use of second-level domains, and work with NITDA to make .ng and .gov.ng the preferred choice for institutions.

Regulation is also changing demand. NITDA’s data classification framework says sensitive data in finance, healthcare and government must be stored in Nigeria, and the CBN has directed that payment transaction data be stored locally by 1 January 2027. Investment is following: one market estimate cited by Nairametrics projects Nigeria’s data centre market to grow from about US$374 million in 2026 to about US$783 million in 2031.

That creates an opportunity and a test. If more regulated data has to stay at home, Nigerian hosting has to be dependable. A market where customers fear losing their site after renewal cannot carry that load.

What good looks like

• Published service levels: clear uptime commitments, support response times and compensation when they are missed.
• Customer ownership of domains: domains registered in the customer’s name, with the transfer code available without delay.
• Automated renewals and reminders: several expiry notices by email and SMS, and grace periods explained up front.
• Security by default: DNSSEC offered at every registrar, free TLS certificates, patched server software and two-factor authentication on control panels.
• Backups customers can download: regular, tested backups stored separately from the main server.
• Resilient power and cooling: redundant power, enough cooling capacity and honest status pages during incidents.

How to protect your business now

You do not need to wait for the industry to improve. Whether you use a local or foreign provider, these steps reduce your risk.

1. Confirm you own your domain. Log in to your registrar account and check that the registrant name and email are yours, not your web designer’s.
2. Turn on auto-renew and renew for several years. Add a calendar reminder 60 days before expiry as a backup.
3. Keep your own backups. Download a full copy of your site files and database at least monthly and store it away from the hosting server.
4. Use an independent uptime monitor. Free services can email you when your site goes down, so you are not relying on customers to tell you.
5. Ask for DNSSEC and two-factor authentication. If your registrar cannot offer them, consider one that can.
6. Document support contacts. Keep tickets, emails and payment receipts. They matter if you need a refund or escalate a dispute.
7. Have a migration plan. Know how to move your files, database and DNS records to another host quickly if service fails.
8. Check data rules. If you handle payment, health or government data, confirm where your provider stores it and whether that meets current localisation requirements.

Frequently asked questions

Should I avoid Nigerian hosting companies altogether?

No. Some local providers are reliable, and hosting close to your users can reduce latency and make naira payment easier. Judge each provider on service levels, support response, backups and reviews rather than on location alone.

What happens if my .ng domain expires?

An expired domain can be deleted and become available to anyone. Renew early, use auto-renew, and make sure renewal notices go to an email address you check.

What is DNSSEC and do I need it?

DNSSEC adds digital signatures to DNS records so visitors are not silently sent to a forged address. It is especially valuable for banks, fintechs, online shops and any brand that is often impersonated.

Where can I complain about a registrar?

Start with the registrar’s support channel and keep records. If a .ng registrar does not resolve the issue, you can raise it with NiRA, which accredits registrars for the .ng namespace.

Next steps

For businesses, spend thirty minutes this week checking domain ownership, renewal dates, backups and monitoring. For hosts and registrars, publish real service levels, automate renewals and switch on DNSSEC and two-factor authentication by default. For regulators and industry bodies, independent reporting of uptime and complaints would help good providers stand out. Nigerian hosting can earn the trust the data localisation era demands, but only if reliability becomes the norm rather than the exception.

Sources

• Techeconomy: .ng domain registrations near 250,000 (NiRA July 2026 update)
• Nairametrics: NiRA records 241,000 active .ng domains
• What happened to HostNowNow? What website owners should know
• Nairametrics: Nigeria's data centres, power and water
• Techpoint Africa: NITDA data classification framework and local hosting
• BusinessDay: Nigeria's local web hosting market

Featured image: Photo: "17° Server Room @ Work" by Leonardo Rizzi, CC BY-SA 2.0, via Openverse — source

Nigerian motorists are being targeted by a text message scam that pretends to come from the Federal Road Safety Corps (FRSC). The message says a traffic offence has been recorded against your vehicle and asks you to tap a link to “review” or pay the fine. The link leads to a convincing fake website. Victims who enter card or bank details have reported losing hundreds of thousands, and in at least one case more than a million, naira.

The FRSC has publicly disowned the messages and called the website fraudulent. An investigation published by Public Enquirer on 16 October 2026 shows the scheme is still active, run on a network of look-alike domains that keep reappearing after takedowns.

How the fake FRSC fine scam works

The scam follows a familiar “smishing” (SMS phishing) pattern, but it has been polished to look official:

1. The text. You receive an SMS from an ordinary phone number saying a new traffic offence has been logged and needs your attention. It includes a link.
2. The fake portal. The link opens a page titled something like “Road Traffic Offences” that asks for your plate number. Whatever you type, it returns a “Pending Fines” screen.
3. The pressure. The page quotes the real FRSC Establishment Act, shows a violation code and offers to halve the fine if you pay within a short window. The legal language and deadline are there to rush you.
4. The theft. You are sent to a payment page and asked for card or account details. The “fine” is small, but what the criminals actually take is much larger.

Two public figures shared their experiences. Actress Eva Ibiam reported a single debit of about ₦364,574 to an unfamiliar foreign merchant, with a one-time password arriving minutes afterwards, a sign the fraudsters were using her details in real time. Comedian MC Monica reported a card charge of about ₦1.85 million to another unknown merchant, and received a second lure from a different web address within hours.

Why these fake sites keep coming back

Public Enquirer traced the operation to a cluster of cheap web addresses designed to look like government sites, including frscgov.top, which the FRSC itself flagged in September, and variants using endings such as .sbs and .cam. One fake domain was set up and hosted within about 82 seconds, which suggests the process is automated. The same infrastructure was also linked to a fake parking-payment site aimed at drivers in Poland, so this is an organised, international operation, not a lone fraudster.

Investigators also found a separate fake FRSC login page that collects email addresses and passwords. Only a handful of the domains have been permanently removed; others moved to new hosting and returned. That means you cannot rely on a site being blocked. You need to recognise the trick yourself.

Warning signs to look for

• The message comes from a regular mobile number rather than an official sender.
• The link does not point to frsc.gov.ng. Look-alikes such as “frscgov”, “frsc-gov” or unusual endings like .top, .sbs, .cam or .cc are red flags.
• It offers a discount for paying fast or threatens extra penalties if you delay.
• It asks for your full card number, expiry date, CVV, PIN or online banking password.
• You receive an OTP you did not request just after visiting the page.

How to check a traffic fine safely

The FRSC says alleged offences should be verified only through its official channels, not through links in unsolicited messages. Its official website is frsc.gov.ng, and its national toll-free line is 122. Type the web address yourself instead of tapping a link, or call the line and ask whether your plate number has any record against it.

The FRSC has also advised motorists not to share banking details, passwords, card details, driver’s licence or vehicle registration information in response to such messages, to keep the messages as evidence, and to stop engaging with the sender.

What you should do

• Do not tap links in texts about traffic fines, licence renewals or vehicle papers. Go to frsc.gov.ng directly or call 122.
• Never enter card details or OTPs on a page you reached from an SMS link.
• If you already paid, call your bank immediately using the number on the back of your card, ask them to block the card and dispute the transaction. Speed matters, because these debits can happen within minutes.
• Change any password you typed into a fake FRSC login page, and change it anywhere else you reuse it.
• Turn on transaction alerts and set daily card spending limits in your banking app, especially for online and foreign transactions.
• Keep the SMS as evidence and report it to your bank and to the FRSC.
• Warn family, drivers and staff, particularly anyone who manages company vehicles, because fleet managers are natural targets for this kind of message.

Sources

• Public Enquirer: How scammers built, deployed a fake version of Nigeria's traffic agency
• TheCable: FRSC disowns viral traffic violation messages, warns motorists against fake website
• Leadership: FRSC Warns Motorists Against Fake Traffic Offence SMS, Website

The National Information Technology Development Agency (NITDA) and the Central Bank of Nigeria (CBN) will bring together regulators, banks, fintech companies and digital infrastructure providers for an Executive Regulatory Dialogue on the National Sovereign Cloud Initiative (NSCI). The meeting, announced on 19 October 2026, is scheduled for 28 October 2026 in Lagos.

The goal is to work out how Nigeria’s push for “sovereign” cloud, meaning cloud services that keep data and control within the country, will be applied in one of the most data-heavy parts of the economy. For anyone who runs payments, lending, savings or accounting systems in the cloud, this is a development to follow closely.

What is on the agenda

According to the announcement, the dialogue will cover regulatory expectations, how ready domestic infrastructure is, and practical approaches to data localisation and sovereign cloud adoption. Four themes are expected to dominate:

• Workload classification: deciding which systems and data must be hosted under sovereign or domestic arrangements, and which can stay where they are.
• Regulatory compliance: how institutions will show they meet the rules.
• Infrastructure capacity: whether local data centres and providers can handle the demand.
• Investment opportunities: where new capacity and services are needed.

The organisers say they want to identify priority actions and areas that still need regulatory clarity, with implementation described as “coordinated, practical and phased”. No new obligations were announced with the dialogue itself.

How we got here

The financial-sector talks build on a set of policy steps taken earlier this year. In August 2026, NITDA Director-General Kashifu Inuwa Abdullahi signed a package of cloud instruments, including a National Cloud Computing Guideline, a National Cloud Technical Guideline and a National Digital Infrastructure Assurance Framework. The assurance framework is meant to verify, through assessment, that cloud and data centre providers actually meet national technical standards rather than simply claiming to. NITDA also set up a taskforce to drive the sovereign cloud programme.

NITDA said a regulatory platform for onboarding, assessing and certifying providers would be running by October 2026, with plans for a public register of certified cloud providers. The agency has stressed that the same standards apply to local providers and global hyperscalers, and that Nigeria is not closing its market to foreign cloud companies.

The CBN’s payment data rules

The CBN’s involvement matters because of its own data localisation directive. As reported, it requires payment transaction data generated in Nigeria to be stored and managed domestically, and covers deposit money banks, microfinance banks, mobile money operators, switching companies and payment service providers, with effect from 1 January 2027. A certified provider register would give these institutions a standard way to check whether a cloud provider meets the requirements, something they previously lacked.

Why this matters beyond the big banks

Even if your business is not a licensed financial institution, these changes may reach you. Many SMEs build on fintech platforms, payment gateways and core banking software, and those partners will be the first to adjust. That could mean new hosting arrangements, updated contracts and data-processing terms, and in some cases price changes as providers pass on the cost of local infrastructure.

There are potential benefits too. More local data centre capacity can mean lower latency for Nigerian users, less exposure to foreign-exchange swings on cloud bills paid in dollars, and clearer rules about where customer data lives, which helps when dealing with the Nigeria Data Protection Act.

Key details are still open, including the exact certification criteria, any fees and how strictly workload classification will be applied. That is precisely what the Lagos dialogue is meant to clarify, so businesses should avoid making expensive moves on rumours alone.

What you should do

1. Map your data. List the systems that hold payment, customer and financial records, and note where each one is hosted.
2. Ask your providers. Write to your cloud, payment and software vendors and ask how they plan to meet the NSCI and CBN requirements, and whether they intend to seek NITDA certification.
3. Review contracts. Check whether your agreements let you choose data location and move data if rules change.
4. Watch for the outcomes of the 28 October dialogue and NITDA’s certified provider register before committing to migrations.
5. Budget early if you are a payment service provider or microfinance bank, since the CBN directive’s January 2027 date is close.

Sources

• Hyperscalers Africa: NITDA, CBN To Convene Financial Sector Dialogue On Data Localisation
• CIO Africa: Nigeria Begins Sovereign Cloud Certification In October
• Lawyard: Nigeria's Certified Cloud Register and financial sector compliance

Featured image: Photo: "Mediq Utrecht Data center Gwan Kho" by Gwan Kho, CC BY-SA 2.0, via Openverse — source

F5, the company behind the NGINX web server, has released out-of-band security updates for several NGINX vulnerabilities, three of which are rated critical. “Out-of-band” means the fixes arrived outside the normal update schedule, which usually signals that the vendor wants administrators to act quickly. NGINX sits in front of a very large share of websites, APIs and cloud applications, including many run by Nigerian banks, fintechs, e-commerce stores and agencies, so this is an update worth putting at the top of this week’s to-do list.

The three critical issues are tracked as CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479. F5 published its advisories in mid-October, and the out-of-band release was widely reported on 19 October 2026.

What the vulnerabilities do

All three flaws are memory-safety bugs in the NGINX worker process. According to the reporting, an unauthenticated remote attacker who sends crafted traffic to a vulnerable server can trigger a heap-based buffer overflow or a use-after-free condition. The most likely result is that the worker process crashes and restarts, which an attacker can repeat to cause a denial of service and knock a site or API offline.

The more serious outcome is remote code execution. Researchers and F5 note that running attacker code is realistic where Address Space Layout Randomization (ASLR), a standard memory protection in modern operating systems, has been disabled, or where an attacker finds a way around it. That condition is the main reason the flaws carry a “High” score of 8.1 under CVSS version 3.1 while scoring 9.2, “Critical”, under the newer CVSS version 4.0 method.

Which products are affected

F5 lists a wide range of NGINX products in its advisories, including:

• NGINX Open Source
• NGINX Plus
• NGINX Ingress Controller (used with Kubernetes)
• NGINX Gateway Fabric
• NGINX Instance Manager

Importantly, exposure depends on how NGINX is configured. The bugs are reachable only with certain non-default settings, such as particular uses of HTTP/3, Server Side Includes (SSI) combined with asynchronous file I/O, or regex-based map directives that reference capture variables. That means you should not assume you are safe just because you run a “standard” setup, and you should not assume you are vulnerable either. The only way to know is to check your configuration against F5’s advisories.

Is anyone exploiting this yet?

At the time of writing, F5 has not reported any exploitation in the wild, and no public proof-of-concept code has been reported. That is good news, but it is not a reason to wait. F5 products are a frequent target: the US Cybersecurity and Infrastructure Security Agency (CISA) has listed eight F5 vulnerabilities as actively exploited since November 2021, and four of those were used in ransomware attacks. F5 also disclosed in October 2025 that state-backed hackers had breached its systems and stolen source code and information about undisclosed vulnerabilities, which raises the stakes for any newly published F5 bug.

Historically, once a fix is public, attackers compare the patched and unpatched code to work out how to exploit the flaw. The window between a patch and the first attacks can be days rather than weeks.

Temporary mitigations if you cannot patch today

Upgrading to a fixed NGINX release is the recommended fix. If you need time to test the update, F5 has described configuration changes that reduce exposure for each flaw:

• CVE-2026-15176: avoid using the alias directive inside a location block and avoid the $request_filename variable.
• CVE-2026-97205: disable asynchronous file I/O (the aio setting) or Server Side Includes (SSI).
• CVE-2026-93479: use named regex captures instead of unnamed (numbered) captures, and keep their use limited to the block containing the regex match.

Treat these as stop-gaps only. Configuration changes are easy to undo by accident during a later deployment, and they may not cover the other, lower-severity issues fixed in the same release.

Why this matters for African businesses

Many small and mid-sized companies in Nigeria and across the continent run NGINX without realising it. It is often bundled in hosting control panels, Docker images, Kubernetes clusters, load balancers and appliances supplied by integrators. If a vendor or freelancer set up your website or app, NGINX may be quietly serving your traffic. A crash-and-restart attack against a payment page or customer portal can mean lost sales and support calls, and code execution on an internet-facing server can become the first step in a data breach.

What you should do

1. Find every NGINX instance. Check web servers, reverse proxies, Kubernetes ingress controllers and container images. Running nginx -v on a server shows the installed version.
2. Read F5’s advisories (K000162416, K000162607 and K000162608) and compare the listed conditions with your configuration files.
3. Patch internet-facing systems first, then internal ones. Update container base images and redeploy, rather than patching running containers by hand.
4. Apply the mitigations above where patching must wait, and record the change so it is reviewed later.
5. Confirm ASLR is enabled on Linux hosts; it is on by default, and it should stay that way.
6. Ask your hosting provider or IT vendor in writing whether they manage NGINX for you and when they will apply the fix.
7. Watch your logs for repeated worker process crashes, which can indicate someone is probing for these bugs.

Sources

• BleepingComputer: F5 releases out-of-band patches for critical NGINX vulnerabilities
• Daily Security Review: F5 Patches Three NGINX Memory-Corruption Flaws Enabling RCE

Many of today’s breaches do not start with clever malware. They start with someone logging in. This month, Japanese media group Nikkei disclosed its third security incident in about a month: attackers used stolen credentials to reach a development system and exposed about 1.83 million records, around 150,000 of which contained personal details such as names and email addresses. Earlier incidents at the same company involved a hijacked Google Workspace account and a compromised Microsoft 365 account that was used to send spear-phishing emails to staff.

Small businesses use exactly the same platforms, often with default settings left untouched. The good news is that both Microsoft 365 and Google Workspace include strong protections, and most can be switched on by an administrator in an afternoon. This guide walks through the most important steps. You will need an account with administrator rights.

Step 1: Protect the admin accounts first

An attacker who controls an administrator account controls everything, so start here.

1. Use separate admin accounts. Give administrators a dedicated admin login that is not used for daily email or browsing.
2. Keep the number small. Two administrators is usually enough for a small business: one main and one backup, so you are never locked out.
3. Turn on the strongest sign-in method available for those accounts, such as a hardware security key or an authenticator app, before anything else.
4. Store a break-glass account securely: an emergency admin login, with its recovery details written down and kept offline.

Step 2: Enforce multi-factor authentication for everyone

Multi-factor authentication (MFA) means a stolen password alone is not enough to sign in. The key word is enforce: offering MFA as optional leaves gaps.

In Microsoft 365

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. If you do not have advanced licences, make sure Security defaults are enabled. They require all users to register for MFA and block older, weaker sign-in methods.
3. If your plan includes Conditional Access, create a policy that requires MFA for all users and all cloud apps, and test it on a small group first.

In Google Workspace

1. Sign in to the Google Admin console (admin.google.com).
2. Go to Security, then the 2-Step Verification settings.
3. Allow users to turn on 2-Step Verification, give staff a short enrolment period, and then set enforcement to on.
4. Where possible, restrict methods to security keys or the Google prompt rather than SMS codes.

Tell staff before you enforce MFA, and set a date. A short notice prevents a Monday morning full of lockouts.

Step 3: Close the side doors

Attackers often bypass MFA through older protocols or connected apps.

• Block legacy authentication. Older email protocols such as POP, IMAP and basic SMTP authentication may not support MFA. In Microsoft 365, Security defaults or a Conditional Access policy can block them. In Google Workspace, review the settings for less secure app access and IMAP for users who do not need them.
• Review third-party app access. Staff may have granted outside apps permission to read mail or files. In Microsoft Entra, review Enterprise applications and consider requiring admin approval for new app consents. In the Google Admin console, open Security > Access and data control > API controls to see and restrict connected apps.
• Stop automatic forwarding. Criminals who take over a mailbox often set a rule to copy all mail to an outside address. Disable automatic external forwarding unless there is a business need.

Step 4: Turn on alerts and check sign-in logs

You want to know quickly when something looks wrong.

1. In Microsoft 365, review sign-in logs in the Entra admin center and alert policies in the Microsoft Defender portal (security.microsoft.com). Look for sign-ins from unexpected countries and new inbox rules.
2. In Google Workspace, use Reporting > Audit and investigation for login events, and check Rules for alerts such as suspicious login and user granted admin privilege.
3. Send alerts to a shared mailbox that more than one person checks.
4. Set a recurring 15-minute weekly slot to skim the logs. Regular, small checks catch problems early.

Step 5: Plan for the day a login is stolen

Even with good controls, an account may be compromised. Prepare the response in advance:

• Know how to reset a password and sign the user out of all sessions in your admin console.
• Know how to revoke app tokens and remove suspicious inbox rules.
• Write a one-page checklist listing who to call, including your IT provider and bank, if a mailbox is used for fraud.
• Remove accounts promptly when staff leave, and transfer their data to a manager.

Quick checklist

• Separate, protected admin accounts, kept to a minimum
• MFA enforced for every user, not just offered
• Legacy sign-in blocked and external forwarding disabled
• Third-party app access reviewed
• Alerts on and logs checked weekly
• A written plan for a compromised account

Menu names change from time to time as Microsoft and Google update their consoles, so if a setting has moved, search for it by name inside the admin portal. The steps themselves remain among the most effective defences a small business can put in place.

Sources

• BleepingComputer: Nikkei discloses third data breach in a month, 1.8M records exposed

Featured image: Photo: “UF Norman Office Laptop Desk Workstation” by cdsessums, CC BY 2.0, via Openverse — source

If your business website, online shop or customer portal runs on PHP, today matters. The PHP security team has scheduled an urgent release for Wednesday, 21 October 2026, at 14:00 UTC (3:00 p.m. in Lagos) to fix two critical remote code execution flaws in PHP core. This article is for website owners, small business IT leads, developers and anyone who manages a WordPress, Laravel or other PHP-based site, whether on shared hosting, a VPS or in containers.

Key takeaways

• PHP will ship fixes for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, on 21 October 2026 at 14:00 UTC.
• The PHP security team rated both flaws 9.2 on the CVSS v4.0 scale. Early online claims of a perfect 10.0 score were not confirmed by PHP.
• Details of the bugs leaked before the planned disclosure, which is why the release was announced at short notice.
• Fixes are expected only for supported PHP 8 branches. Sites still on PHP 5 or PHP 7 will not receive an official patch.
• No public exploit code or in-the-wild attacks had been reported at the time of the announcement, but that can change quickly once technical details become public.

What happened

On the evening of Tuesday, 20 October 2026, Jakub Zelenka posted an advance notice from the PHP security team on the official php.announce mailing list. It warned of an upcoming critical security release fixing two vulnerabilities, each scored 9.2 under CVSS version 4.0, and set the release for 14:00 UTC on Wednesday, 21 October. The notice also said the team could publish earlier if details of either flaw became public or if there was evidence of active exploitation, and it urged users to prepare so they can update as soon as the new versions are available.

The timing was not ideal. Earlier the same day, a post on the Hacker News forum claimed that a source had revealed two PHP remote code execution bugs, with an announcement expected on 22 October. That post was later removed, but screenshots spread across X and Mastodon, and some posts listed the reserved CVE numbers. Security firm watchTowr publicly confirmed that the leak related to real, embargoed PHP vulnerabilities, while making clear it had not discovered them and would not share technical details. PHP’s official schedule effectively brought the fix forward by about a day.

What we know about the flaws

Very little technical information has been published, and that is deliberate. According to security advisories from Beazley Security Labs and Threat Landscape, both CVE records are still marked as reserved. PHP has not said which function or extension is affected, which configurations are vulnerable, or whether an attacker needs to be logged in. Some advisories note that a critical rating like this could point to unauthenticated remote code execution, but PHP has not confirmed that.

Remote code execution is the most serious class of web bug because it can let an attacker run their own commands on your server. In practice that can mean defaced pages, stolen customer data, hidden malware that redirects visitors, or a foothold for wider attacks on your network.

Which versions are affected

PHP has not yet published official affected or fixed version ranges; these will come with the release. Public reporting suggests the current releases of the 8.2, 8.3, 8.4 and 8.5 branches are affected. Claims that every version back to PHP 5 is affected came from social media and have not been confirmed. What is clear is that PHP 5 and PHP 7 are end-of-life, so they will not receive official fixes regardless.

Who is affected

PHP powers a very large share of the web, including popular content management systems such as WordPress, Joomla and Drupal and many custom business applications. That makes this release relevant to:

• Small businesses and NGOs with a website on shared hosting, where the host controls the PHP installation.
• Developers and agencies managing client sites on VPS or cloud servers, where you are responsible for updates.
• Teams using containers, where old PHP base images can linger in production long after newer builds exist.
• Organisations running appliances or third-party products that bundle their own copy of PHP.

Across Nigeria and the wider continent, many SMEs rely on low-cost shared hosting and on developers who built a site years ago and have since moved on. Those sites are often running older PHP versions that nobody has checked recently. If that sounds like your organisation, treat this as the prompt to find out.

Why the leak raises the stakes

Coordinated disclosure normally gives defenders a head start: the fix and the details arrive together, and attackers have to work backwards from the patch. When details leak early, that head start shrinks. Advisories note that researchers have largely respected the remaining embargo, and at least one researcher has said they will publish a technical lab only after the embargo lifts. Even so, once patched versions are public, attackers can compare old and new code to find the bug. Sites that update within days are in a far stronger position than those that wait weeks.

What you can do before the release

1. Build an inventory

List every server, hosting account, container image and appliance that runs PHP. Record the version for each. On a server you can run php -v; on WordPress you can check under Tools > Site Health > Info > Server; in cPanel, the MultiPHP Manager shows the version for each domain.

2. Talk to your host or distribution

If you use shared or managed hosting, ask your provider when they will roll out patched PHP builds and whether you need to do anything. If you run Linux servers, watch your distribution’s security advisories, because many teams install PHP from distribution packages rather than directly from php.net.

3. Reduce exposure

Advisories recommend restricting non-public PHP applications, such as internal admin panels and staff portals, to trusted networks or VPN access. Internet-facing applications that cannot be patched quickly should be isolated where possible.

4. Plan your upgrade path off old PHP

If you find PHP 5, 7, 8.0 or 8.1 anywhere, prioritise moving it to a supported PHP 8 branch. According to php.net, the supported branches are 8.2, 8.3, 8.4 and 8.5, and PHP 8.2 itself only receives security fixes until 31 December 2026, so moving to 8.3 or newer buys more time.

What you should do

1. Today: confirm which PHP versions you run and who is responsible for updating each one.
2. After 14:00 UTC: check php.net and your host or distribution for the patched versions, then apply them as soon as they are available. Test critical functions such as checkout, contact forms and logins afterwards.
3. This week: watch for exploit reports. If public exploit code appears, treat any unpatched internet-facing site as urgent.
4. This quarter: retire any PHP version that no longer receives security updates and make PHP version checks part of your regular maintenance routine.

Sources

• php.announce: Upcoming Critical PHP Security Release
• Beazley Security Labs: Critical RCE Vulnerabilities in PHP
• Threat Landscape: PHP Core RCEs Leak Early
• PHP: Supported Versions

Featured image: Photo: “First Web Server” by User:Coolcaesar at en.wikipedia, CC BY-SA 3.0, via Openverse — source

Oracle released its October 2026 Critical Patch Update on Tuesday, 20 October, and it is a very large one. It matters to any organisation that runs Oracle software, from large enterprises using E-Business Suite or WebLogic to small development teams that simply have Java or MySQL somewhere in their stack. This article explains what was fixed, which systems to patch first, and how smaller IT teams can approach a release of this size without getting overwhelmed.

Key takeaways

• The update contains 1,295 security patches addressing 1,209 unique CVEs across 33 Oracle product families.
• According to Tenable’s analysis, 95 CVEs are rated critical and 439 are rated high.
• Hundreds of the fixes address flaws that can be exploited remotely without a username or password.
• Several flaws in Oracle Fusion Middleware, E-Business Suite and JD Edwards carry the maximum CVSS v3 score of 10.0.
• Oracle’s risk matrices do not flag any of the flaws as exploited in the wild, but attackers often study patches quickly, so delay is risky.

What Oracle released

Oracle’s quarterly Critical Patch Update (CPU) is its main vehicle for security fixes. The October 2026 edition, the last quarterly CPU of the year, covers 33 product families, including Oracle Database Server, Java SE, MySQL, E-Business Suite, Fusion Middleware, Enterprise Manager, PeopleSoft and Siebel CRM.

Tenable’s breakdown, published via Security Boulevard, puts the severity split at 95 critical CVEs, 439 high, 582 medium and 93 low. In patch terms, critical fixes make up just under 9 percent of the total, while high-severity fixes account for more than a third.

Where the fixes are concentrated

Two product families take the largest share. Oracle Fusion Middleware, which includes WebLogic Server, SOA Suite and Access Manager, received roughly 200 patches, and E-Business Suite received 194. Other heavily patched families include:

• Siebel CRM, with 122 patches
• Oracle Communications, with 110 patches
• PeopleSoft, with 109 patches
• JD Edwards, with 102 patches
• MySQL, with 98 patches
• Java SE, with 55 patches, most of which are remotely exploitable without authentication

Oracle Database Server received a much smaller set of 13 patches, one of them rated critical.

The most serious flaws

SecurityOnline’s analysis highlights a group of flaws rated 10.0, including issues in the E-Business Suite Workflow Notification Mailer, the Access Manager authentication engine, SOA Suite components and the JD Edwards EnterpriseOne Orchestrator. Several WebLogic Server core flaws are rated 9.8, some reachable over the T3 and IIOP protocols and others over plain HTTP. A 9.8-rated issue in Database Server relates to its bundled OpenSSL component, and Oracle APEX also has a 9.8-rated fix.

The common thread is that many of these flaws are reachable over the network and, in a number of cases, need no login. That is exactly the profile attackers look for in internet-facing business systems.

Why this matters even without known attacks

Oracle’s advisories do not report active exploitation for this batch, and no public proof-of-concept had been confirmed when analysts wrote about the release. That is good news, but it is not a reason to wait. Analysts warn that attackers often reverse-engineer Oracle patches within days of release. SecurityOnline also recalls CVE-2025-61882, an E-Business Suite flaw abused in a 2025 data theft and extortion campaign, as a reminder of how valuable these systems are to criminals.

For Nigerian and African organisations, this is not a distant problem. Oracle ERP, database and middleware products run in many large organisations across the region, and many mid-sized companies use Java-based or MySQL-backed applications built by local vendors. Systems that hold payroll, customer and financial data are prime targets for extortion.

How to prioritise a release this big

No team can apply 1,295 patches at once. A sensible order, based on analysts’ recommendations, looks like this:

1. Internet-facing middleware and ERP first. Patch WebLogic, SOA Suite, Access Manager and E-Business Suite servers that are reachable from the internet.
2. Remote, no-login flaws next. Work through every remaining fix that Oracle’s risk matrices mark as remotely exploitable without authentication.
3. Internal systems in the next maintenance window. Database Server, MySQL and Java SE installations that are not directly exposed can follow, but should not be left for months.

If you cannot patch immediately

• Block T3 and IIOP traffic from untrusted networks, since several WebLogic and SOA Suite flaws use those protocols.
• Keep E-Business Suite and middleware administration consoles off the public internet; put them behind a VPN or restrict them to known IP addresses.
• Increase monitoring of logs on exposed Oracle systems until patches are in place.

Don’t forget the hidden Oracle software

Smaller organisations often do not think of themselves as “Oracle customers”, yet Java runtimes and MySQL databases sit inside many line-of-business applications, accounting tools and websites. Ask your software vendors whether their products bundle Java or MySQL and when they will ship updated builds.

Oracle’s move towards more frequent patching

Alongside the quarterly CPU, Oracle has been publishing monthly Critical Security Patch Update advisories in recent months, and its October announcement encourages customers to adopt a monthly security patching cycle. For many teams that will mean changing how they schedule maintenance windows and test updates. It is worth starting that conversation now rather than when the next large release arrives.

What you should do

• Identify every Oracle product you run, including Java and MySQL embedded in third-party applications.
• Read Oracle’s October 2026 advisory and its risk matrices for the products you use.
• Patch internet-facing WebLogic, SOA Suite, Access Manager and E-Business Suite systems first.
• Apply temporary network restrictions where patching must wait.
• Review your patch process so you can handle Oracle’s monthly security updates in future.

Sources

• Oracle Security Blog: October 2026 Critical Patch Update Released
• Security Boulevard (Tenable): Oracle October 2026 CPU Addresses 1209 CVEs
• SecurityOnline: Oracle Critical Patch Update October 2026
• Oracle Critical Patch Update Advisory – October 2026

Featured image: Photo: “17° Server Room @ Work” by Leonardo Rizzi, CC BY-SA 2.0, via Openverse — source

Nigerian authorities have issued a string of warnings this month about sextortion, a form of online blackmail that is now being boosted by artificial intelligence. The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) raised the alarm at its October cybersecurity awareness events in Abuja, and NITDA’s computer emergency response team issued an advisory about criminals using AI to create fake explicit images. This alert is for everyone who uses social media, dating apps or messaging apps, and especially for parents, teachers and employers who look out for young people and staff.

Key takeaways

• Sextortion is blackmail: criminals threaten to release intimate images or videos unless the victim pays money, sends more images or meets other demands.
• NITDA warns that criminals can now use AI to create convincing fake explicit images, so you can be targeted even if you never shared anything.
• Paying does not make it stop. Blackmailers usually come back for more.
• Save evidence, stop responding, report the account to the platform and report the crime to the police cybercrime centre.
• Sharing someone’s intimate images without consent is an offence in Nigeria, and the police say cases involving children are treated as particularly serious.

What the authorities are saying

On 17 October 2026, at the World Cyber Security Awareness Walkathon in Abuja, AIG Akaninyene Ezima, who heads the NPF-NCCC, warned Nigerians about romance scams and sexual extortion, in which fraudsters build online relationships to obtain intimate photos and later threaten to publish them. He also flagged investment fraud that shows victims fake profit dashboards before blocking withdrawals, and noted that some Nigerians have lost hundreds of millions of naira, with others losing billions, to such schemes.

Days earlier, the Inspector-General of Police used the centre’s 2026 awareness campaign to list common online offences, including sharing someone’s nude or private photos or videos without consent. He urged victims of sextortion, fraud and cyberbullying to come forward and report.

In early October, NITDA’s CERRT advisory warned of rising sextortion threats and the growing use of AI-generated explicit images. It stressed that children, teenagers and adults can all be targeted.

How the scam works, step by step

1. First contact

According to NITDA, the approach often starts on social media, messaging apps, dating platforms or even online games. The account may look like an attractive stranger, a fellow student or a new business contact. NITDA notes that it may be impossible to verify who is really behind such an account.

2. Building trust

The criminal invests time in friendly or romantic chat. Police say fraudsters use these online relationships to gain trust, with the aim of getting the victim to share private photos or videos.

3. The trap closes

Once they have images, or have created fake ones with AI, the tone changes. The victim is threatened that the material will be published or sent to people they know unless they pay or comply.

4. Escalating demands

The first payment is rarely the last. NITDA warns that complying does not guarantee the threats stop, and blackmailers may keep asking for more money or more images.

The AI twist: fakes made from ordinary photos

The newest danger is that a criminal no longer needs a real intimate image. NITDA’s advisory explains that AI tools can be used to create convincing fake explicit images. In practice that means a normal profile picture, graduation photo or work headshot could be misused. Victims may feel they have no defence because “it looks real”. Remember: the shame belongs to the criminal, not to you, and a fake image is still evidence of a crime.

Warning signs

• A new online contact who moves very quickly to flirting or romantic talk.
• Pressure to switch from a public platform to a private messaging app or video call.
• Requests for photos, or attempts to steer a video call towards undressing.
• A profile with few real connections, recently created, or using photos that look too polished.
• Sudden threats, a countdown or a list of your contacts appearing in a message.
• Any demand for money or more images in exchange for “deleting” content.

How to protect yourself and your family

• Do not send intimate images or videos online, even to people you know or trust. This is NITDA’s first recommendation.
• Lock down your profiles. Police urge caution about sharing personal information and photos online, so limit who can see your friends list, photos and workplace.
• Be careful with strangers on dating apps, social media and gaming platforms, and treat unverified accounts with caution.
• Talk to children and teenagers. NITDA notes that young victims often stay silent out of fear or shame. Make it clear they can come to you without being punished.
• Employers: include sextortion in staff security awareness sessions, so employees know it is safe to ask for help if they are targeted.

What to do if you are a victim

1. Do not pay and do not send more images. Paying rarely ends the threats.
2. Save evidence before blocking. Take screenshots of messages, usernames, profile details, phone numbers, payment requests and account details. Do not delete the chat.
3. Stop all contact once you recognise the threat.
4. Report the account and the content to the platform where it happened.
5. Use StopNCII.org. This free service creates a digital fingerprint of an image on your own device, without uploading it, so that participating platforms such as Facebook, Instagram, TikTok and Snapchat can block it from being posted.
6. Report to the police. The NPF-NCCC accepts reports through its e-reporting portal at nccc.npf.gov.ng/ereport and by email at nationalcybercrimecenter@nccc.npf.gov.ng.
7. Get support. NAPTIP’s cybersecurity response team handles online exploitation, and organisations such as WARIF, the Mirabel Centre and, for minors, the Cece Yara Foundation offer counselling and legal support. If you have already paid money, you can also report to the EFCC.

What you should do

Share this alert with family members, students and staff, and agree a simple rule at home and at work: if anyone is ever threatened with intimate images, real or fake, they should tell someone they trust, keep the evidence and report it, without paying a single naira. Sextortion depends on fear and silence; speaking up early takes away the criminal’s power.

Sources

• Nairametrics: NITDA warns Nigerians over rising sextortion threats
• Gazette: Police warn Nigerians against online scams
• Vanguard: IGP warns Nigerians against seven online offences
• Zikoko: What to do if someone threatens to leak your nudes in Nigeria

Most small business websites run on PHP, the programming language behind WordPress and many other platforms. Yet few owners know which PHP version their site uses, or that old versions stop receiving security fixes. With PHP shipping an urgent security release on 21 October 2026 and PHP 8.2 reaching the end of its security support on 31 December 2026, now is a good time to check. This step-by-step guide is for business owners, office managers and junior web admins using shared hosting with cPanel, or a WordPress site. You do not need to be a developer to follow it.

Key takeaways

• You can see your PHP version in WordPress under Tools > Site Health > Info > Server, or in cPanel’s MultiPHP Manager.
• As of October 2026, php.net lists PHP 8.2, 8.3, 8.4 and 8.5 as supported. Anything older gets no security fixes.
• Always back up your files and database before changing PHP versions.
• Test on a staging copy first if your host provides one, then switch the live site.
• If something breaks, switch back temporarily, but only to a version that still receives security updates.

Why your PHP version matters

Each PHP branch gets a period of active support, followed by a period where it receives only security fixes, and then nothing at all. According to php.net’s supported versions page, as of 21 October 2026:

• PHP 8.5: active support until 31 December 2027, security fixes until 31 December 2029.
• PHP 8.4: active support until 31 December 2026, security fixes until 31 December 2028.
• PHP 8.3: security fixes only, until 31 December 2027.
• PHP 8.2: security fixes only, ending 31 December 2026.

A site on PHP 7.4, 8.0 or 8.1 will not get patches for newly discovered flaws, including critical ones.

Before you start: prerequisites

• Your hosting control panel login (often cPanel) or your WordPress administrator login.
• A recent, complete backup that includes both the site files and the database.
• A list of the plugins and theme your site uses.
• About an hour at a quiet time for your business, such as late evening or a weekend morning.
• Your host’s support contact, in case your plan does not let you change PHP yourself.

Step-by-step: check your current PHP version

Option A: inside WordPress

1. Log in to your WordPress dashboard as an administrator.
2. Go to Tools > Site Health. On the Status tab, look for a recommended improvement about PHP; WordPress flags outdated versions here.
3. Click the Info tab, then expand the Server section. The PHP version is listed there.
4. Write the version down.

Option B: in cPanel

1. Log in to cPanel.
2. In the Software section, open MultiPHP Manager. If you cannot see it, your host may have disabled it, so contact support.
3. Find your domain in the list. The PHP version assigned to it is shown alongside. If it says inherit, the site uses the server’s default PHP version.

Step-by-step: update PHP safely

Step 1: Back up everything

Copy all of your site files and export your database. A backup is only useful if it includes both. Many hosts offer a one-click backup tool in cPanel, and WordPress users can use a backup plugin such as Duplicator. Download a copy to your computer or cloud storage, not just to the same server.

Step 2: Check plugin and theme compatibility

Visit each plugin’s page in the WordPress plugin directory and check the PHP version it supports. Update all plugins, themes and WordPress itself to their latest versions before changing PHP, because updates often add support for newer PHP releases. Plugins that have not been updated in years are a warning sign; plan to replace them.

Step 3: Test on a staging copy

If your host offers a staging site, create one so it matches your live site, then change PHP on the staging copy only. If no staging option exists, choose a quiet time and be ready to switch back.

Step 4: Change the PHP version in cPanel

1. Open MultiPHP Manager.
2. Tick the checkbox next to the domain you want to change.
3. Choose the new version from the PHP Version drop-down menu. Versions your host recommends are labelled Recommended.
4. Click Apply. If PHP-FPM is enabled for the domain, it updates to match automatically.

A good target for most sites today is PHP 8.3 or 8.4. If a version is missing from the list, it is not installed on your server or not available on your plan; ask your host.

Step 5: Test the important things

Open your site in a private browser window and test what matters to your business: the home page, navigation, contact and enquiry forms, newsletter sign-up, comments, logins and, for online shops, the full checkout process.

Step 6: Apply to the live site

Once staging works, make the same change on the live site, then repeat your tests.

Troubleshooting

The site shows a blank page or “critical error”

Switch back in MultiPHP Manager to the previous version so customers are not affected, then investigate on staging. Only roll back to a version that still receives security updates.

Finding which plugin is the problem

On a staging site, set WP_DEBUG to true in the wp-config.php file to display PHP errors and deprecated function warnings. Error messages usually name the plugin or theme folder causing trouble. Update it, replace it with a maintained alternative, or ask its developer for a fix. Turn debugging off again afterwards.

You cannot change the version yourself

Some shared hosting plans restrict PHP changes. Open a support ticket and ask the host to move your domain to a supported version, or ask about moving to a plan that allows it.

Checklist

• Current PHP version noted.
• Full backup of files and database saved off the server.
• WordPress core, plugins and theme updated.
• Plugin compatibility checked; abandoned plugins listed for replacement.
• PHP changed on staging and tested.
• PHP changed on the live site and key functions tested.
• Debug mode switched off.
• Calendar reminder set to check PHP and plugin updates every month.

Next steps

Keeping PHP current is not a one-time task. Ask your host to confirm how quickly they apply PHP security releases, such as the critical update scheduled for 21 October 2026, and add a monthly website health check to your routine. If you rely on an outside developer, ask them to confirm the PHP version in writing and to plan upgrades well before each branch reaches its end of support.

Sources

• cPanel Docs: MultiPHP Manager for cPanel
• PHP: Supported Versions
• WPMU DEV: How to Update PHP to the Suggested WordPress Version

AI tools are becoming part of everyday work for developers, analysts and small businesses. Many of these tools do not run their own AI models. Instead, they connect to providers such as OpenAI, Anthropic or Google using an API key, a long secret string that lets software use the provider’s service and bills the key owner for every request. A security incident disclosed over the weekend shows how valuable, and how exposed, those keys can be.

What happened at OpenCode

OpenCode is an open-source AI coding agent that helps people understand code, write features and fix bugs using plain-language instructions. It runs in a terminal, a desktop app or a code editor, and users can link their own accounts with several AI providers through a web dashboard called the OpenCode Console.

On Saturday, 17 October 2026, the project disclosed what it described as a large-scale “distillation attack”. According to reporting by BleepingComputer, the incident affected about 1.4% of OpenCode Console users, specifically those who had linked external AI providers. The API keys those users had stored were exposed. OpenCode said the earliest possible exposure was 00:30 UTC on 17 October and that it had seen no evidence of other data being taken.

The consequences were immediate for some people. Users reported unauthorised charges on their AI accounts ranging from several hundred dollars to more than $1,700 overnight, and some said Google had suspended their cloud projects for activity consistent with hijacked resources. OpenCode emailed affected users, said those without an email were not affected, mentioned possible reimbursement, and said it was working with the AI providers involved.

What is a distillation attack?

Distillation itself is a legitimate machine-learning technique: a smaller model is trained on the answers produced by a larger, more capable model. It becomes an attack when someone runs that process at huge scale without permission, often using other people’s accounts so the cost and the rule-breaking land on someone else. Stolen API keys are ideal for this, because each one comes with a paid account and its own usage limits. OpenCode’s co-founder said attackers had been probing the company’s systems for at least 48 hours, using AI agents of their own.

Why AI API keys are a growing target

An AI API key is essentially a prepaid or post-paid credit line. Unlike a stolen password, it often does not need a second factor to use, and it may keep working until someone notices the bill. There are three reasons the risk is rising:

• More places hold keys. Coding agents, browser extensions, automation tools and no-code platforms all ask you to paste a key in.
• Usage is easy to monetise. Criminals can resell access, use it for distillation, or run spam and scam content at your expense.
• Costs scale fast. Automated misuse can run thousands of requests an hour, so a bill can grow overnight, as OpenCode users found.

None of this means AI tools are unsafe to use. It means an API key deserves the same care as a bank card.

How to protect your AI API keys

1. Use one key per tool. Create a separate key for each app or service. If one is exposed, you can revoke it without breaking everything else, and you can see which tool leaked.
2. Set spending limits and alerts. Most AI provider dashboards let you set monthly budgets, usage alerts or caps. Set them low and raise them when needed.
3. Limit permissions. Where the provider allows it, restrict keys to specific models, projects or features, and use separate projects for testing and production.
4. Never put keys in code or chats. Keep them out of source code, shared documents, screenshots and messaging groups. Use environment variables or a secrets manager, and add key files to your .gitignore.
5. Rotate keys regularly, and immediately after any breach notice from a tool you use.
6. Remove keys you no longer use. Old keys sitting in forgotten tools are easy pickings.
7. Protect the provider account itself with multi-factor authentication, since anyone in the account can create new keys.
8. Check billing weekly during the first months of using any new AI tool.

What to do if you used OpenCode

• Check your inbox for a notification from OpenCode. The company says users who did not receive one were not affected.
• If you linked AI providers to the OpenCode Console, revoke those keys in each provider’s dashboard and create new ones as a precaution.
• Review your AI and cloud billing for charges since 17 October and contact the provider about anything unexpected.
• If a cloud project was suspended, follow the provider’s appeal process and explain the breach.

The lesson is broader than one tool. As AI services become everyday business utilities, the keys that unlock them become targets, and simple habits such as separate keys, spending caps and regular rotation can turn a potentially expensive incident into a minor inconvenience.

Sources

• BleepingComputer: OpenCode hack exposes API keys amid AI distillation attacks