AI Cyber Risk is evolving faster than many organizations can adapt, prompting a joint warning from the Five Eyes cyber security agencies. The agencies have called on business leaders, executives, and boards to act now, warning that advances in artificial intelligence are rapidly transforming the cyber threat landscape and shortening the time available to respond to emerging risks. In a coordinated statement, the leaders of the Five Eyes cyber security partnership said that while AI has the potential to improve defensive capabilities, it is also accelerating the speed, scale, and sophistication of cyber attacks. They cautioned that developments in Frontier AI are expected to exceed current industry expectations and could fundamentally change both offensive and defensive cyber operations within months rather than years.

AI Cyber Risk Demands Immediate Attention

The agencies stressed that AI is no longer a future consideration. According to the statement, AI is already lowering barriers for malicious actors and increasing the complexity of attacks. At the same time, it is reducing the gap between the discovery of vulnerabilities and their exploitation. As a result, organizations are being urged to assess their readiness, understand accountability structures, and strengthen foundational Cyber Security practices. The agencies emphasized that cyber resilience should be viewed as a critical component of business continuity, market confidence, and long-term organizational value. Leaders were encouraged to remain actively engaged as threats continue to evolve and new guidance emerges.

Frontier AI Is Accelerating Cyber Risk

The Five Eyes agencies warned that Frontier AI models are advancing faster than many organizations anticipate and could fundamentally reshape both cyber attacks and cyber defence within months. As these systems evolve, long-standing assumptions about cyber risk, threat detection, and vulnerability management may quickly become outdated.

The agencies cautioned that organizations that fail to adapt could face growing operational and strategic disadvantages. They emphasized that leaders should not view AI-driven cyber risk as a future challenge but as an immediate business concern requiring proactive planning, continuous assessment, and investment in cyber resilience. As AI capabilities expand, the agencies said organizations must remain prepared for rapidly changing threats and emerging vulnerabilities that may challenge traditional security approaches.

Cyber Resilience Is a Leadership Responsibility

The Five Eyes agencies stated that Cyber Resilience can no longer be treated solely as a technical issue. Instead, it should be considered a core Business Risk and a leadership responsibility. According to the statement, boards and executives must ensure that cyber resilience measures are not only implemented but are capable of functioning effectively during real-world incidents. The agencies noted that having security controls in place is not enough. Organizations must be confident those controls will perform under pressure. They also called on leaders to reassess long-standing trade-offs and adopt AI deliberately to strengthen defensive capabilities rather than focusing exclusively on operational efficiency.

Key Cyber Security Principles Highlighted

The agencies identified several principles organizations should adopt to address evolving AI Threats. They stated that Secure-by-Design and secure-by-default approaches should become standard practice rather than long-term goals. They also warned against relying on a single security solution, emphasizing that layered security remains essential. The statement further noted that as AI systems continue to evolve, organizations should expect new and previously unknown vulnerabilities to emerge, including Zero-Day Vulnerabilities. The agencies acknowledged that breaches are likely to occur and emphasized that preparedness is essential for containing incidents quickly and preventing them from escalating into larger operational and financial crises.

Practical Actions for Organizations

To reduce technical, operational, financial, and reputational exposure, the Five Eyes agencies outlined several practical actions. Organizations were advised to reduce their attack surface by limiting unnecessary system access and external connectivity. They were also encouraged to accelerate patching processes, warning that AI is shortening the time available between vulnerability disclosure and exploitation. The agencies highlighted unsupported legacy systems as strategic liabilities that can become easy targets for attackers. They also urged organizations to review and strengthen Identity and Access Controls, limit access to critical systems, enforce strong authentication, and regularly assess permissions. In addition, they recommended testing Incident Response plans, training teams, and preparing for breaches before they occur, with a focus on rapid containment and recovery.

Using AI to Strengthen Defense

The agencies noted that threat actors are already using AI to improve their capabilities and increase operational speed. As a result, defenders must also embrace AI-driven security tools. According to the statement, organizations that integrate AI into security operations can improve vulnerability detection, enhance software quality, identify unusual activity, and accelerate response efforts. The agencies emphasized that success will not depend on having the largest number of security tools. Instead, it will come from strong fundamentals, rapid action, and integrating cyber security into core business strategy.

Five Eyes Call for Collective Action

The Five Eyes leaders concluded that assumptions about cyber threats can become outdated within months due to the rapid pace of AI development. They urged organizations, including technology vendors, to act now, strengthen resilience, and remain prepared to adapt to changing threats. The agencies said leaders who move quickly can reduce exposure, strengthen resilience, and build trust among customers, partners, and investors. Those who delay, they warned, face growing and avoidable risk.

Microsoft has rolled out its May 2026 Patch Tuesday security updates, delivering fixes for approximately 120 vulnerabilities across Windows, Microsoft Office, networking services, and enterprise platforms. Unlike several recent monthly releases, this update contains no publicly disclosed or actively exploited zero-day vulnerabilities, making it a relatively less chaotic cycle for IT and security teams.  Even without emergency-level exploits, the Microsoft May 2026 Patch Tuesday release remains significant due to the large number of critical flaws addressed. The company confirmed that the update resolves 17 critical vulnerabilities, including 14 remote code execution (RCE) flaws, two elevation-of-privilege issues, and one information disclosure vulnerability. 

Microsoft May 2026 Patch Tuesday: Vulnerabilities That Demand Attention 

One of the most important areas covered in the May 2026 Patch Tuesday update involves multiple vulnerabilities affecting Microsoft Office applications, particularly Word and Excel.  According to Microsoft, attackers could exploit these flaws by tricking users into opening malicious files. Several of the vulnerabilities can also be triggered through the preview pane, allowing remote code execution without fully opening the attachment.  Because Office documents remain a common attack vector in phishing campaigns, security professionals are strongly recommending that organizations prioritize deployment of these updates, especially in environments where employees regularly receive external attachments. 

Windows GDI Flaw Allows Exploitation Through Microsoft Paint 

Among the noteworthy issues patched during Microsoft’s May 2026 Patch Tuesday rollout is CVE-2026-35421, a Windows GDI remote code execution vulnerability.  The flaw can be exploited through a malicious Enhanced Metafile (EMF) image opened in Microsoft Paint. Successful exploitation could allow attackers to execute arbitrary code on the victim’s machine.  Although the attack requires user interaction, researchers warned that image-based attacks are often effective because users may not recognize specially crafted files as dangerous. 

SharePoint and DNS Vulnerabilities Raise Enterprise Security Concerns 

Another major vulnerability addressed in the May 2026 Patch Tuesday release is CVE-2026-40365, a remote code execution flaw affecting Microsoft SharePoint Server.  Microsoft stated that an authenticated attacker could use the vulnerability to launch a network-based attack capable of remotely executing code on vulnerable SharePoint systems. Since SharePoint environments often store sensitive internal data and business documents, the flaw is expected to receive close attention from enterprise administrators.  The company also patched CVE-2026-41096, a serious Windows DNS Client remote code execution vulnerability. The flaw involves improper handling of specially crafted DNS responses sent by attacker-controlled DNS servers.  The issue stems from a heap-based buffer overflow condition in Windows NetLogon functionality. A successful attack could corrupt system memory and allow remote code execution without requiring authentication. 

Dynamics 365 Vulnerability Carries Near-Maximum Severity Score 

Another critical issue fixed during the Microsoft May 2026 Patch Tuesday cycle is CVE-2026-42898, a remote code execution vulnerability affecting on-premises versions of Microsoft Dynamics 365.  The flaw received a CVSS severity score of 9.9 and requires no user interaction for exploitation. Researchers warned that attacks targeting Dynamics 365 environments could have widespread consequences because the platform frequently connects with multiple enterprise systems and sensitive databases.  Previous attacks involving Dynamics infrastructure have exposed privileged business information, making this vulnerability especially concerning for large organizations.

Windows 11 Cumulative Updates Introduce New Features 

As part of the May 2026 Patch Tuesday rollout, Microsoft released Windows 11 cumulative updates KB5089549 and KB5087420 for versions 25H2, 24H2, and 23H2.  The updates are mandatory because they contain the latest security fixes and stability improvements.  After installation: 

• Windows 11 25H2 updates to build 26200.8457  
• Windows 11 24H2 updates to build 26100.8457  
• Windows 11 23H2 updates to build 22631.7079  

Microsoft confirmed that versions 25H2 and 24H2 share the same underlying update structure, meaning users receive identical fixes and improvements across both versions. 

Xbox-Inspired Desktop Experience Added to Windows 11 

One of the more noticeable additions included in the Microsoft May 2026 Patch Tuesday update is a new Xbox-style desktop experience for PCs.  The feature is designed to provide a console-like interface on Windows devices. Alongside the visual changes, Microsoft also introduced reliability improvements for the taskbar and enhancements to Windows Hello authentication.  The update improves both Windows Hello Face recognition reliability and the persistence of fingerprint authentication across system upgrades. 

File Explorer Receives Major Improvements 

File Explorer received several updates in the latest May 2026 Patch Tuesday release.  Microsoft expanded archive support to include formats such as: 

• uu  
• cpio  
• xar  
• NuGet Packages (nupkg)  

The company also improved how File Explorer preserves View and Sort preferences in folders like Downloads and Documents when applications directly launch those locations.  Additionally, Microsoft fixed a white flash issue that sometimes appeared in dark mode while opening “This PC” or resizing the Details pane.  Explorer.exe reliability was also enhanced to reduce crashes and improve overall responsiveness. 

Input, Voice Typing, and Haptic Feedback Enhancements 

The Microsoft May 2026 Patch Tuesday updates introduced several improvements to input and accessibility features.  Compatible devices can now provide haptic feedback during actions such as snapping windows or aligning PowerPoint objects. Current supported hardware includes: 

• Surface Slim Pen 2  
• ASUS Pen 3.0  
• MSI Pen 2  

Microsoft added that support for additional peripherals, including select mouse devices, could arrive in future hardware updates.  Voice typing on the touch keyboard also received a redesign. The updated interface removes the previous full-screen overlay and displays animations directly on the dictation key to reduce distractions. In addition, Microsoft introduced the Arabic 101 Legacy keyboard layout for users who prefer the earlier Arabic keyboard configuration.

Storage, Printing, and Performance Updates Included 

Several broader system improvements were bundled into the May 2026 Patch Tuesday release.  Microsoft increased the FAT32 formatting limit through the command line from 32GB to 2TB. The update also improves storage settings performance when viewing large disk volumes. Additional changes include: 

• Reduced memory usage in Delivery Optimization  
• Improved audio driver compatibility with midisrv.exe  
• Better taskbar system tray reliability  
• Enhanced startup application performance  
• Improved monitor color profile persistence  
• Simplified kiosk mode app configuration  

The update also introduces a new icon identifying printers that support Windows Protected Print Mode. 

Microsoft Introduces More Secure Batch File Processing 

Microsoft added a new security-focused feature aimed at administrators and enterprise policy managers.  The May 2026 Patch Tuesday update introduces a secure processing mode for batch files and Command Prompt scripts. When enabled, the feature prevents batch files from being modified during execution.  Administrators can activate the setting using the following registry path:  Registry Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor  Value Name: LockBatchFilesWhenInUse  The feature can also be enabled through Application Control for Business policies. 

Microsoft’s Patch Tuesday April 2026 release has introduced one of the most extensive security update rollouts of the year, addressing a total of 167 vulnerabilities across Windows operating systems and associated software. This latest Microsoft Patch Tuesday also includes fixes for two zero-day vulnerabilities, one of which was actively exploited in real-world attacks, alongside critical flaws affecting SharePoint Server, Microsoft Defender, and Microsoft Office.  The April edition of Microsoft Patch Tuesday highlights the complexity of modern cyber threats. Among the 167 vulnerabilities patched, eight are classified as “Critical.” Of these, seven involve remote code execution (RCE), while one relates to a denial-of-service (DoS) issue. The remaining vulnerabilities fall under various categories: 

• 93 Elevation of Privilege vulnerabilities
• 13 Security Feature Bypass vulnerabilities
• 20 Remote Code Execution vulnerabilities
• 21 Information Disclosure vulnerabilities
• 10 Denial of Service vulnerabilities
• 9 Spoofing vulnerabilities

Additionally, the security update addresses two zero-day vulnerabilities and several flaws in Microsoft Office applications. 

Microsoft Patch Tuesday: Zero-Day Vulnerabilities in Focus  

A major focus of this Patch Tuesday April 2026 cycle is the remediation of two zero-day vulnerabilities. One of the most concerning issues is an actively exploited spoofing vulnerability in Microsoft SharePoint Server. According to Microsoft, “Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.”   The company further explained that a successful attack could allow threat actors to access sensitive information and modify it, affecting both confidentiality and integrity, though not availability. Microsoft has not disclosed details about how the vulnerability was exploited or who discovered it.  The second zero-day, tracked as CVE-2026-33825, affects Microsoft Defender and allows attackers to gain SYSTEM-level privileges. This flaw has been resolved in Microsoft Defender Antimalware Platform version 4.18.26050.3011, which is being distributed automatically. Users can also manually install the update via Windows Security settings. The vulnerability was discovered by Zen Dodd and Yuanpei XU from HUST working with Diffract. 

Critical Vulnerabilities and Exploitation Risks 

Beyond zero-days, Microsoft Patch Tuesday April 2026, includes several critical vulnerabilities that demand immediate attention. For instance, CVE-2026-23666 affects the .NET framework and could allow attackers to execute a denial-of-service attack over a network.  Another critical flaw, CVE-2026-32157, impacts the Remote Desktop Client. It is a use-after-free vulnerability that can lead to code execution if a user connects to a malicious server. Similarly, multiple Microsoft Office vulnerabilities, such as CVE-2026-32190, CVE-2026-33114, and CVE-2026-33115, require local code execution but can be triggered remotely, often through malicious documents or even the preview pane. This makes them particularly dangerous in environments where users frequently handle email attachments.  CVE-2026-33824 targets the Windows Internet Key Exchange (IKE) extension and allows unauthenticated attackers to send specially crafted packets to achieve remote code execution. Microsoft recommends blocking inbound UDP ports 500 and 4500 if IKE is not in use as a mitigation step.  Other notable critical issues include vulnerabilities in Active Directory (CVE-2026-33826) and Windows TCP/IP (CVE-2026-33827), both of which could enable remote code execution under specific conditions. 

Office and SharePoint Remain High-Risk Targets 

This Patch Tuesday April also noted the risk posed by Microsoft Office and SharePoint. Multiple RCE vulnerabilities in Word and Excel can be exploited through malicious files, reinforcing the need for users to update their Office installations promptly.  Another vulnerability, CVE-2026-32201, affects SharePoint and allows spoofing attacks that can expose and alter sensitive data. This issue has already been observed in active exploitation.  While most vulnerabilities are rated as “Important,” security researchers have flagged several as more likely to be exploited. These include flaws in UEFI Secure Boot (CVE-2026-0390), Windows Kernel memory disclosure (CVE-2026-26169), and multiple elevation-of-privilege issues affecting components like WinSock, BitLocker, and the Desktop Window Manager.  Other notable vulnerabilities include spoofing issues in Remote Desktop and Windows Shell, as well as security bypass flaws in Windows Hello and BitLocker.  Outside of Microsoft, this Patch Tuesday April period also saw Google release fixes for its fourth Chrome zero-day vulnerability of 2026. Meanwhile, Adobe issued an emergency update for Acrobat Reader to address an actively exploited remote code execution flaw.