Office gets system-wide Copilot shortcuts; Microsoft issues 120 security patches

Microsoft just did two very different things on the same day, but they point in the same direction. It made Copilot easier to reach across Microsoft 365 apps, and it shipped a big monthly security update fixing 120 vulnerabilities. One move is about convenience. The other is about risk control. Put them together and the message is pretty clear — AI inside Office is no longer a side feature you can ignore. ### What changed in Office? The visible change is simple. Microsoft is unifying how you open Copilot in Word, Excel, PowerPoint, and Outlook, replacing the old mix of sidebars and app-specific entry points with a more standard floating icon and common keyboard behavior. The rollout is live now in Word and Outlook for Windows and Mac in English, with other apps coming later. (techcommunity.microsoft.com) ### Why do the shortcuts matter? Because interface changes decide what people actually use. If Copilot lives behind different buttons in every app, lots of users never build a habit. If the entry point is always in the same place and the shortcut works the same way, Copilot stops feeling like an add-on and starts feeling built in. Microsoft is also framing this as a keyboard-first and accessibility improvement, especially for screen-reader users. (techcommunity.microsoft.com) ### Is this just a button move? Not really. Microsoft has been pushing Copilot deeper into the apps themselves, not just into a chat pane. In recent weeks it also made more agentic features generally available in Word, Excel, and PowerPoint, meaning Copilot can take multi-step actions directly inside documents, worksheets, and decks while the user stays in control. The shortcut cleanup is the UI layer that makes that deeper integration easier to use every day. (techcommunity.microsoft.com) ### What happened on the security side? May 2026 Patch Tuesday landed with fixes for 120 vulnerabilities across Microsoft products, and none were listed as publicly disclosed or actively exploited zero-days. That sounds calmer than some recent months, but the release was still large. BleepingComputer counted 17 critical flaws in the batch, with remote code execution bugs making up a big share of the serious issues. (microsoft.com) ### Why is “no zero-days” not the whole story? Because volume still matters, and so does attack type. A month without a known in-the-wild zero-day is good news, but 120 fixes still means a lot of reachable surface area got cleaned up at once. Remote code execution bugs are the scary class because they can let attackers run code on a target system. So this was a quieter Patch Tuesday, not a small one. (bleepingcomputer.com) ### How do these two stories connect? Basically, Microsoft is normalizing AI as part of the Office fabric at the same time it is maintaining the usual enterprise patch drumbeat. That matters because the more often users trigger Copilot from inside documents, spreadsheets, presentations, and email, the less sense it makes to treat AI as some separate pilot project. It is just part of the productivity stack now — with all the usual governance baggage attached. (bleepingcomputer.com) ### What should IT teams take from this? The practical takeaway is boring but important. Treat Copilot like a standard app surface, not a novelty. That means reviewing where it appears by default, who can access it, what data it can touch, and how changes roll out across platforms and languages. Then keep doing the old work too — patch fast, especially when Microsoft drops a triple-digit security release. (techcommunity.microsoft.com) ### Bottom line? Microsoft is making Copilot easier to summon and harder to ignore. On the same May 13, 2026 news cycle, it also reminded everyone that the Microsoft 365 estate still lives on a monthly security clock. Convenience is winning — but only if patching and controls keep up. (techcommunity.microsoft.com)