All our stories, in order, Dakar time (GMT).
Friday 23 October
A leak on a forum forced the PHP team to bring its release forward. The flaws, CVE-2026-109618 and CVE-2026-109619, allow code to be run on a server remotely. Fixes have been available since October 21, but not every version is protected.
Monday 19 October
To mark fifty years of its signals corps, Senegal’s military on Friday co-hosted the first Africa Cyber Network conference with a private company. Vice Admiral Oumar Wade urged government agencies, businesses, universities and citizens to take a share in defending the country’s cyberspace.
Thursday 15 October
Senegal’s police are warning about fake streaming apps, spread over WhatsApp, that steal mobile money PINs and then empty accounts from the victims’ own phones. How these programs work, the warning signs, and the Android settings worth checking tonight.
Tuesday 13 October
Overnight on October 11-12, refrigerated cabinets in several hundred Intermarché, U, Carrefour, Monoprix and Leclerc stores were switched into defrost mode and set to 50°C. No data was stolen, but tonnes of food had to be thrown away and some equipment caught fire. The weak point: ageing Danfoss controllers reachable from the internet.
Tuesday 6 October
Users in Senegal say their Wave accounts were emptied without them authorising anything, sometimes of their entire salary. Fake bonuses, fake agents, codes coaxed out of victims: here are the tricks fraudsters are known to use, the habits that protect you and what to do if it is already too late.
Sunday 4 October
A few weeks before the Dakar 2026 Youth Olympic Games, Senegal is also preparing on another front: cybersecurity. Since 28 September, a series of exercises has been testing the country’s ability to detect, manage and coordinate a response to a cyber crisis.
Friday 2 October
A critical vulnerability affecting Fortinet FortiMail is currently being exploited by attackers. CISA has added it to its catalogue of exploited flaws, and administrators concerned are urged to apply the security measures recommended by Fortinet without delay.
Wednesday 30 September
Internet shutdowns, public Wi-Fi, remote work: the VPN has become an everyday tool, in Senegal and elsewhere. But a bad choice is costly, and a glitch does not always justify switching providers. Our guide, with no brand to sell.
In its report on the hack of France’s tax administration (DGFiP), the cybersecurity agency ANSSI describes an attack with no genius involved: credentials stolen from personal computers, portals without two-factor authentication and data thefts nobody noticed. Commonplace flaws found in many administrations, in Africa too.
Tuesday 29 September
Stolen credentials, customer databases, remote access: a small business’s data can be resold months before an attack. Tools, some of them free, make it possible to find out in time. How they work, what they cost and what to do with an alert.
Monday 28 September
A Lagos court rejected the idea that non-users whose numbers sit in someone’s phonebook give “implied consent”. For lack of proof of harm, the case was nonetheless dismissed. Truecaller points out that anyone can remove their number.
A scam can target one country, cash out in a second and launder the money in a third within hours. For Franck Kié (Cyber Africa Forum) and Ouanilo Medegan Fagla (Benin’s CNIN), only permanent African cooperation can keep up.
Sunday 27 September
An Italian bank lost €95 million because of a lawyer’s voice imitated by AI. Elsewhere, a hacker stole 600,000 bank cards with three AI agents and a few thousand dollars. Two cases that change how we need to protect ourselves.
Saturday 26 September
Hackers spent three weeks inside a system that IT provider MIP was in the process of retiring. About 400,000 records stolen, a ransom paid, and data published anyway. Regulators point out that insurers remain responsible.
Friday 25 September
The biggest crypto theft of the year. The exchange has suspended withdrawals and suspects North Korean hackers. It promises to repay users through its protection fund.
The first ECOWAS biometric cards expire in October 2026. The deadline has been known since 2016, but the state is preparing an extension whose length and beneficiaries have not been set, after a cyberattack that halted production.
Tuesday 22 September
Six organisations hit in one month, and a worrying statistic: nearly one in two South African ransomware victims lacked adequate protection, according to Sophos’s annual survey.
Thursday 17 September
A text message announces a traffic offence, a fake FRSC website offers a reduced fine, and the security code sent by the bank is immediately used for a purchase abroad. Anatomy of a scam that changes address every day.
Thursday 3 September
The country’s largest bulk water supplier confirmed on 3 September an incident affecting some of its IT systems. Treatment, quality and supply are operating normally, according to the state-owned company.