Microsoft and Windows 2025–2026: what happened and why it matters

The period opened with the exploitation of a zero-day in self-hosted SharePoint servers. Reports counted roughly 100 targeted organizations, mostly government agencies in the US and Germany, and Google tied at least one of the actors to China. SharePoint came back in US cybersecurity agency alerts in March 2026 and again in July 2026, when a remote code execution flaw was added to the known-exploited catalog; it needs only basic site-member permissions.

Microsoft's own data set the backdrop. Its annual threats report said extortion and ransomware drive over half of attacks with known motives, and that 97% of identity attacks are password-related. In October 2025 Azure absorbed what Microsoft called the largest cloud DDoS ever recorded, 15.72 Tbps from a botnet using more than 500,000 IP addresses. In December the company confirmed it would retire the RC4 cipher after 26 years, citing its exposure to Kerberoasting, the technique behind the Ascension breach.

In 2026 attention moved to the defenses of Windows itself. A researcher using the name Nightmare Eclipse published exploit code for BitLocker and Defender, including YellowKey, which lets someone with physical access bypass default BitLocker settings on Windows 11. Microsoft's threat of legal action drew criticism over a chilling effect on research. In June a Defender zero-day called RoguePlanet was reported to give SYSTEM-level access on fully updated machines, while a Netlogon flaw was under active attack on domain controllers.

Copilot went from experiment to core business. By August 2025 the coding assistant had 20 million users, 5 million of them added in three months, and Satya Nadella said it was already a bigger business than the code-hosting platform was when Microsoft bought it in 2018. In October the consumer assistant received an animated character meant to be easier to disable than Clippy was.

Growth exposed friction. In March 2026 reports described Copilot inserting promotional text into pull requests, with estimates of the affected volume ranging from thousands to over a million. In April the platform paused new sign-ups for its Pro, Pro+ and Student plans because long, parallel agentic sessions were routinely costing more than the monthly fee, and tightened usage limits on individual plans.

Microsoft's answer to agent risk was tooling. In March it made Agent 365, a control plane for AI agents, generally available at 15 dollars per user per month, plus a 99-dollar suite, citing its own finding that nearly 29% of enterprise agents run without approval. An agent governance toolkit mapped to OWASP risks followed in April, then the open-sourcing of RAMPART and Clarity in May and the SkillOpt framework in June. A separate small model, Phi-4-reasoning-vision-15B, claimed rival performance on about 200 billion training tokens versus over one trillion for competitors.

Spending announcements came country by country. Microsoft pledged more than one billion dollars in Thailand for 2026 to 2028, 10 billion dollars in Japan for 2026 to 2029 along with training a million engineers by 2030, and A$25 billion in Australia through 2029, its largest there, adding more than 140% to Azure AI supercomputing capacity. A separate letter of intent with Nscale covers a West Virginia campus planned around 430,000 Nvidia Vera Rubin NVL72 units.

Scrutiny grew in parallel. The US Federal Trade Commission stepped up its probe of Microsoft's cloud and AI business, sending demands to rivals about licensing and the bundling of AI, security and identity software. Italy's competition authority opened a case on how the Microsoft 365 price rise was communicated, since users were moved to a pricier plan with Copilot unless they opted out. Against that, NHS England is deploying Copilot to more than 505,000 staff, a roughly 120 million pound deal, after a pilot of 30,000 users saving 43 minutes a day on average.

Dependence became a procurement question. The International Criminal Court decided to leave Microsoft Office for the European open-source Open Desk after US sanctions on its chief prosecutor, though Microsoft denied cancelling his email account. Scottish police authorities said Microsoft declined to share key data on international data flows. Airbus, which began leaving Office for Google Workspace over seven years ago, still has finance teams tied to Excel files of up to 20 million cells.

Governments went further. France's digital directorate announced on 8 April 2026 that it will move its workstations from Windows to Linux, and every ministry must plan by autumn 2026 to cut dependence on non-European infrastructure. In August China was reported to be mandating the removal of Windows 10 from certain government agencies, with domestic Linux suppliers Kylin and UnionTech seeing their shares jump. No single replacement distribution was named in either case.

The platform kept diversifying. Windows 11 26H1 was reserved for new Arm PCs with Snapdragon X Elite chips and cannot upgrade to 26H2, although it gets the same monthly updates as 24H2 and 25H2. In July 2026 the Windows Subsystem for Linux gained a public preview of Linux containers with a built-in command-line tool and API. At Build, Microsoft showed a developer PC with up to 128GB of memory and Project Solara, an Android-based platform where devices run AI agents instead of apps.

The gaming side and the bugs completed the picture. Steam ended support for 32-bit Windows from 1 January 2026, and after a 50% rise in Game Pass Ultimate prices Microsoft reaffirmed its investment in its own consoles. A Blizzard story team unionized with the company's recognition. Quality slips continued: an October 2025 update left USB keyboards and mice dead in the recovery environment, and a January 2026 patch kept some PCs from shutting down.