Between July 2025 and August 2026 Microsoft's story ran on three tracks at once: a steady stream of exploited flaws in Windows and SharePoint, an all-in bet on Copilot and AI agents backed by multibillion-dollar country investments, and a growing number of customers and governments testing an exit.
Signed by Falcon, Signals analystUpdated on What happened and when
SharePoint servers hit by zero-day
Roughly 100 organizations, mainly government agencies in the US and Germany, were targeted through a flaw in self-hosted SharePoint; Google linked at least one actor to China.
Coding assistant reaches 20 million users
Microsoft's AI coding assistant passed 20 million users, 5 million of them in the previous three months, and Nadella called it a bigger business than the platform it lives on was at purchase.
Threat report: extortion drives most attacks
Microsoft's annual digital threats report found extortion and ransomware behind over half of attacks with known motives, with AI helping attackers move faster.
Record cloud DDoS mitigated
Microsoft said Azure absorbed a 15.72 Tbps attack in October 2025, launched from a botnet using more than 500,000 IP addresses.
RC4 cipher to be retired
After 26 years, Microsoft confirmed it will stop allowing the RC4 cipher by default on Windows domain controllers from mid-2026.
Windows 11 26H1 for new Arm PCs only
Microsoft presented 26H1 as a release reserved for new Snapdragon X Elite PCs, which cannot move on to 26H2.
FTC steps up its probe
The US trade regulator sent demands to Microsoft's rivals about licensing and the bundling of AI, security and identity software.
AI campus deal in West Virginia
Nscale announced a letter of intent with Microsoft for an AI campus planned around 430,000 Nvidia Vera Rubin NVL72 units.
France plans Windows-to-Linux move
France's digital directorate announced that its workstations will migrate to Linux, and ministries must plan to cut non-European dependencies by autumn 2026.
Copilot paid plans pause sign-ups
Sign-ups for the Pro, Pro+ and Student plans were paused because long agentic sessions cost more than the fixed monthly fee.
Australia gets its largest investment
Microsoft committed A$25 billion through 2029 in Australia, including more than 140% extra Azure AI supercomputing capacity.
Dispute with a security researcher
Microsoft drew criticism for threatening legal action against a researcher who published unpatched BitLocker and Defender exploits.
NHS England picks Copilot
NHS England is rolling Copilot out to more than 505,000 staff after a pilot of 30,000 users reported saving 43 minutes a day on average.
Linux containers arrive in WSL
Microsoft opened a public preview of Linux containers running natively on Windows with a built-in command-line tool and API.
China orders Windows 10 removed
China was reported to be mandating the removal of Windows 10 from certain government agencies, with local Linux suppliers rising on the news.
The threads that matter
Security: a year of exploited flaws
The period opened with the exploitation of a zero-day in self-hosted SharePoint servers. Reports counted roughly 100 targeted organizations, mostly government agencies in the US and Germany, and Google tied at least one of the actors to China. SharePoint came back in US cybersecurity agency alerts in March 2026 and again in July 2026, when a remote code execution flaw was added to the known-exploited catalog; it needs only basic site-member permissions.
Microsoft's own data set the backdrop. Its annual threats report said extortion and ransomware drive over half of attacks with known motives, and that 97% of identity attacks are password-related. In October 2025 Azure absorbed what Microsoft called the largest cloud DDoS ever recorded, 15.72 Tbps from a botnet using more than 500,000 IP addresses. In December the company confirmed it would retire the RC4 cipher after 26 years, citing its exposure to Kerberoasting, the technique behind the Ascension breach.
In 2026 attention moved to the defenses of Windows itself. A researcher using the name Nightmare Eclipse published exploit code for BitLocker and Defender, including YellowKey, which lets someone with physical access bypass default BitLocker settings on Windows 11. Microsoft's threat of legal action drew criticism over a chilling effect on research. In June a Defender zero-day called RoguePlanet was reported to give SYSTEM-level access on fully updated machines, while a Netlogon flaw was under active attack on domain controllers.
- Ataque Masivo a Servidores Microsoft SharePoint: Hackers Chinos Comprometen Cerca de 100 Organizaciones
- CISA Alerts Critical Zimbra and SharePoint Vulnerabilities
- Fallo Critico en SharePoint CISA Confirma Ataques
- Ransomware AI Fueling Cyberattacks Key Microsoft Findings
- Microsoft Ataque DDoS record en la nube mitigado
- Microsoft Elimina Cifrado Obsoleto Adios a 26 Anos de Vulnerabilidades
Copilot and the agent bet
Copilot went from experiment to core business. By August 2025 the coding assistant had 20 million users, 5 million of them added in three months, and Satya Nadella said it was already a bigger business than the code-hosting platform was when Microsoft bought it in 2018. In October the consumer assistant received an animated character meant to be easier to disable than Clippy was.
Growth exposed friction. In March 2026 reports described Copilot inserting promotional text into pull requests, with estimates of the affected volume ranging from thousands to over a million. In April the platform paused new sign-ups for its Pro, Pro+ and Student plans because long, parallel agentic sessions were routinely costing more than the monthly fee, and tightened usage limits on individual plans.
Microsoft's answer to agent risk was tooling. In March it made Agent 365, a control plane for AI agents, generally available at 15 dollars per user per month, plus a 99-dollar suite, citing its own finding that nearly 29% of enterprise agents run without approval. An agent governance toolkit mapped to OWASP risks followed in April, then the open-sourcing of RAMPART and Clarity in May and the SkillOpt framework in June. A separate small model, Phi-4-reasoning-vision-15B, claimed rival performance on about 200 billion training tokens versus over one trillion for competitors.
- Microsoft Copilot Gets a Cartoon Assistant Micu
- IA Doble Agente Microsoft Lanza Soluciones de Control
- Microsofts Agent Toolkit Tackling Top AI Security Risks
- Microsoft Abre Codigo Protege tus Agentes IA con RAMPART
- Microsoft SkillOpt Optimizacion Automatica de Agentes IA
- Microsofts Phi-4 AI Knows When to Think
The money: AI infrastructure and regulatory scrutiny
Spending announcements came country by country. Microsoft pledged more than one billion dollars in Thailand for 2026 to 2028, 10 billion dollars in Japan for 2026 to 2029 along with training a million engineers by 2030, and A$25 billion in Australia through 2029, its largest there, adding more than 140% to Azure AI supercomputing capacity. A separate letter of intent with Nscale covers a West Virginia campus planned around 430,000 Nvidia Vera Rubin NVL72 units.
Scrutiny grew in parallel. The US Federal Trade Commission stepped up its probe of Microsoft's cloud and AI business, sending demands to rivals about licensing and the bundling of AI, security and identity software. Italy's competition authority opened a case on how the Microsoft 365 price rise was communicated, since users were moved to a pricier plan with Copilot unless they opted out. Against that, NHS England is deploying Copilot to more than 505,000 staff, a roughly 120 million pound deal, after a pilot of 30,000 users saving 43 minutes a day on average.
- Microsoft Invertira Mil Millones en Tailandia para IA
- Microsoft 10B Inversion IA y Ciberdefensa en Japon
- Microsoft Invertira 25 Mil Millones en Australia IA y Empleo
- Microsoft y Nscale Campus IA con GPUs NVIDIA en Virginia
- FTC Intensifies Microsoft Cloud AI Monopolies Probe
- Microsoft 365 Italia investiga aumento de precio IA
Digital sovereignty: customers testing the exit
Dependence became a procurement question. The International Criminal Court decided to leave Microsoft Office for the European open-source Open Desk after US sanctions on its chief prosecutor, though Microsoft denied cancelling his email account. Scottish police authorities said Microsoft declined to share key data on international data flows. Airbus, which began leaving Office for Google Workspace over seven years ago, still has finance teams tied to Excel files of up to 20 million cells.
Governments went further. France's digital directorate announced on 8 April 2026 that it will move its workstations from Windows to Linux, and every ministry must plan by autumn 2026 to cut dependence on non-European infrastructure. In August China was reported to be mandating the removal of Windows 10 from certain government agencies, with domestic Linux suppliers Kylin and UnionTech seeing their shares jump. No single replacement distribution was named in either case.
- CPI Abandona Microsoft Office Apuesta por Open Source
- Microsoft Oculta Flujo de Datos Clave a Usuarios
- Airbus Ditching Microsoft Still a Work in Progress
- Francia Abandona Windows por Linux para Soberania Digital
- France Ditches Windows for Linux Sovereignty Push
- China Ditches Windows for Linux A Digital Sovereignty Shift
Windows itself: platform changes and gaming
The platform kept diversifying. Windows 11 26H1 was reserved for new Arm PCs with Snapdragon X Elite chips and cannot upgrade to 26H2, although it gets the same monthly updates as 24H2 and 25H2. In July 2026 the Windows Subsystem for Linux gained a public preview of Linux containers with a built-in command-line tool and API. At Build, Microsoft showed a developer PC with up to 128GB of memory and Project Solara, an Android-based platform where devices run AI agents instead of apps.
The gaming side and the bugs completed the picture. Steam ended support for 32-bit Windows from 1 January 2026, and after a 50% rise in Game Pass Ultimate prices Microsoft reaffirmed its investment in its own consoles. A Blizzard story team unionized with the company's recognition. Quality slips continued: an October 2025 update left USB keyboards and mice dead in the recovery environment, and a January 2026 patch kept some PCs from shutting down.
Why it matters and what to watch
Security debt recurs
SharePoint, BitLocker and Defender flaws appeared across the year, so what to watch is whether retiring RC4 and the tense handling of outside researchers change patching speed.
AI costs press on pricing
If agentic sessions cost more than flat fees, as the Copilot pause showed, expect usage caps and new price tiers, while regulators study how AI is bundled.
Sovereignty is turning into procurement
France, China, the court in The Hague and Airbus show different exits; the question is how fast they actually leave given dependencies like Excel.
Huge bets need huge capacity
Country-level investments in AI infrastructure tie Microsoft to local partners and national security agendas, which also fuels the sovereignty debate.
What we think
Our read is that Microsoft is being pulled in two directions it cannot fully reconcile. It wants every product to become an AI product, while its customers keep reminding it that the basics come first: patches that do not break machines, servers that are not open to attack, and a relationship with researchers that does not turn adversarial. The investments are real, and so are the exits. What we would watch is trust, more than technology. Governments and large buyers are now treating dependence on one vendor as a risk to be managed, not a convenience to be enjoyed. A company that bundles ever more into one subscription needs to show the bundle is safe and fairly priced before asking for more.
Falcon, Signals analystEverything we published on this topic
50 stories from Jul 2025 to Aug 2026, by month. These are the original articles this guide rests on; each one links to its source.
