National Information Technology Development Agency (NITDA) has issued an urgent cybersecurity warning about a serious Microsoft Office vulnerability (CVE-2026-21509) that attackers are actively exploiting.

This advisory, shared through Nigeria’s Computer Emergency Response Team (CERRT.NG), highlights the risks of this flaw and recommends immediate action to protect systems.

Microsoft has released quick security updates to fix this vulnerability, which has a severity score of 7.8, showing it is a serious risk. Attackers have already used it in targeted attacks.

CVE-2026-21509 affects multiple versions of Microsoft Office, including Office 2016, Office 2019, Microsoft 365 Apps, Office 2021, and later versions.

This flaw allows attackers to bypass security features meant to stop harmful Object Linking and Embedding (OLE) controls. OLE is an older Microsoft technology that can be used to embed links or content, but it has often been exploited by malware.

By exploiting this flaw, attackers can create specially designed Office documents.

When a user opens these documents, they can run malicious code or gain further access to the system.

Exploitation requires user interaction, meaning attackers often trick people into opening harmful Word, Excel, or other Office documents. Common methods include using email attachments or files from untrusted sources.

Because Microsoft confirmed that the vulnerability is being actively exploited, they have made emergency security updates available outside their usual schedule. Users and organisations should:

1. Install the latest Microsoft Office security updates for all affected versions.
2. Restart Office applications for Office 2021 and later to ensure that the updates take effect.
3. Use registry-based settings for protection if updates can’t be applied right away.
4. Follow good cybersecurity practices, like using endpoint protection and filtering emails.

Microsoft’s updates for Office 2021 and newer versions are automatically applied, but need a restart of the applications to be active.

Nigeria Data Protection Commission (NDPC) has commenced an investigation into over 1,000 education institutions across the country over compliance with the Nigeria Data Protection Act (NDP Act), 2023.

The move affects federal, state and private universities, polytechnics, colleges of education and technical colleges, marking one of the largest sector-wide compliance checks since the enactment of the law.

In a public notice issued on Thursday by Babatunde Bamigboye, head, Legal, Enforcement and Regulation, the Commission said the probe forms part of its ongoing sector-by-sector enforcement drive aimed at safeguarding the fundamental rights and freedoms of data subjects, as well as strengthening the legal foundation of Nigeria’s digital economy through the trusted use of personal data.

The NDPC directed the affected institutions to submit, within 21 days, evidence of filing their 2024 Data Protection Compliance Audit Returns, proof of designation or appointment of a Data Protection Officer including relevant contact details and a summary of technical and organisational measures adopted to protect personal data within their establishments.

It also requested evidence of registration as a Data Controller or Processor of Major Importance as required by law.

The Commission warned that failure to comply with the notice may result in the issuance of enforcement orders, imposition of administrative fines and possible criminal prosecution in accordance with the provisions of the NDP Act, 2023.

It stressed that compliance is mandatory and not optional for institutions that process large volumes of personal data

The education sector remains one of the biggest handlers of sensitive personal information in the country, including students’ academic records, admission details, biometric data, financial information and staff records.

With increasing digitalisation of admissions, online learning platforms and electronic documentation systems, concerns over data breaches and weak privacy safeguards have grown in recent years.

The Commission maintained that the investigation is in line with its statutory mandate under relevant sections of the Act empowering it to monitor, investigate and enforce compliance across sectors.

Chams Holding Company Plc, (Chams Holdco), digital payments and verification firm, has created a new subsidiary which is expected to strengthen the push for Africa’s digital transformation.

The creation of the new subsidiary, ChamsCorp Plc, which took effect from February 1, was made known in a filing to the Nigerian Exchange Limited , according to an announcement.

Chams said that the new subsidiary, which is its 5^th, will give a new dimension to its more than 40 years of work in building the digital ecosystem not only in Nigeria, but across the continent and the rest of the world.

The newly created company will focus on three major aspects, namely the manufacturing of digital devices and development of digital infrastructure and services; data center design, construction and operations, and the development and implementation of AI infrastructure and intelligent systems.

It will also contribute to its parent company’s digital ID, digital verification, and trust services offering.

“For nearly four decades, we’ve enabled trust in transactions and identity. Now, we go furthe”

Chams is expanding into AI, data centre infrastructure, and intelligent systems, building the backbone for Africa’s digital transformation,” the company wrote in a LinkedIn post.

“We are not just participating in the future. We are engineering it,” the message added.

According to the Chams announcement, a decision of its Board of Directors appointed members of the pioneer board of ChamsCorp Plc, with renowned banker Mohammed Bashir Yunusa designated as Chairman.

He is described as a well-known finance expert who specializes in deal structuring, corporate and retail finance, business strategy, digital transformation, and Islamic Finance and Banking.

With more than 10 years of experience in the financial services industry, Yunusa currently serves as head of Consumer and Digital Banking for Non-Interest Banking Retail at Sterling Bank Nigeria, and will also serve as a non-executive director on the board.

“Chamscorp is designed to take our most ambitious ideas to market at speed and scale. As Africa’s digital economy evolves, we are focused on delivering transformative solutions that empower governments, businesses, and citizens alike,” Femi Oyenuga, CEO, Chams, commented on the development.

Chams has over the years played a major role in contributing to Nigeria’s digital ID ecosystem development to facilitate access to financial services.

In 2023, the company Group Chairman publicly stated that in providing such digital services to the Nigerian government, it had incurred debts estimated at $100 million and were planning to change their business model as a result.