Aeon Raises $1m for Cybersecurity as PHP2Shell Flaws Expose Nigerian Servers

Nigerian cybersecurity startup Aeon reportedly raised $1 million in September 2026 to expand its capabilities, in a funding round led by Terra Industries. The raise comes as warnings over two critical PHP vulnerabilities, collectively called PHP2Shell, renew concerns about how exposed Nigerian public and private systems are to remote attacks.

The two flaws, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP, a programming language widely used to build websites and applications. According to reported security advisories, attackers could exploit them to run malicious code remotely on affected servers without authentication.

The PHP2Shell threat

Successful exploitation could expose confidential information, knock out online services and open the door to further attacks on connected systems. For government institutions, that could mean citizens' records and essential public services at risk. Banks and businesses face operational disruption, financial losses and reputational damage.

Security experts stress that discovery of a vulnerability does not mean affected systems have already been compromised. The advice to institutions is to update software, assess their exposure, tighten access controls and train staff. Regular vulnerability assessments and clear incident-response procedures are also recommended, with priority given to internet-facing systems.

Nigeria's expanding digital economy has raised the stakes. Outdated software, weak access controls and poor monitoring leave organisations open, and employee training matters because technology alone cannot close every gap.

What Aeon is building

Aeon is among the local technology companies developing cybersecurity and defence capabilities for Nigerian organisations. Beyond products, the startup has done institutional training, including a cybersecurity engagement with the Nigerian Correctional Service. Such work can help public-sector staff recognise threats, protect sensitive information and respond better when incidents occur.

The $1 million round reflects growing investor interest in locally built security tools as government services and commercial transactions move online, according to TechCabal. Building internationally competitive solutions, however, will take sustained spending on technical expertise, research, product development and collaboration with institutions.

The wider fraud problem

The funding also lands against a grim fraud picture. West Africa lost more than N1 billion to fraud between January and June 2026 that conventional security tools failed to catch, according to a threat landscape report by cybersecurity firm Esentry. The firm said three separate fraud incidents were only discovered after routine audits, customer complaints and settlement warnings, not because any security system flagged them.

For Nigerian businesses and public agencies, the immediate priority is to find vulnerabilities before attackers do. As more government services and payments go online, security is becoming a core operational duty rather than an occasional technical concern. Local solutions may help fill the gap, but only if organisations also fix basic hygiene: patched software, controlled access and staff who know what a suspicious event looks like.