The official explanations say what broke. They don’t explain why so much of the world had no way around it.

In less than 48 hours, two of the systems the modern world depends on most stopped working.

Starting on Thursday night, Microsoft 365 went down for about 21 hours. Outlook, Teams and Copilot failed for governments, courts, hospitals and businesses on several continents. Then on Friday afternoon, US time, the Federal Aviation Administration grounded every departing flight in the United States for more than four hours. It was the longest US shutdown since 9/11, and thousands of flights were cancelled.

Both organisations moved quickly to say what didn’t happen: no cyberattack and no malicious activity. Those reassurances matter. They also leave the most important questions open.

The official story, briefly

Microsoft says a process on its servers that sets up secure connections became overwhelmed. Servers went offline, and the remaining servers buckled under the traffic they had to absorb. The company is rolling back a recent network configuration change that started at the same time as the outage.

The FAA’s explanation is even plainer. US Transportation Secretary Sean Duffy said “old switches, old routers” were overloaded with data and failed. “This is a legacy system problem,” he said, according to Nextgov. Homeland Security Secretary Markwayne Mullin said patches and new equipment were overwhelming the older system.

Neither explanation is far-fetched. Most major tech failures start with a routine change that goes wrong, not with a villain. But “a configuration change” and “old routers” describe the trigger. They don’t explain why the damage spread so far.

Question one: Who allowed one change to reach the whole world?

Large cloud providers are supposed to roll out changes in stages: first to a small group of servers, then to a region, and only then everywhere. That process exists to stop a bad change before it spreads.

So why did a single change knock out email for users around the world for most of a day? Why did repeated attempts to bring servers back fail? At one point Microsoft admitted its fixes weren’t “resulting in sustained recovery”. Microsoft will probably publish a Post Incident Review. What matters is whether it explains the safety checks that failed, not just the trigger.

Question two: Is modernisation now a risk of its own?

The FAA story has an uncomfortable detail: officials blame new equipment overloading old equipment. CBS News, citing several unnamed sources, reports that the outage followed an update to the private communications network that links the air traffic control system. That network is operated by L3Harris. After the update, the network rebooted and then crashed. No official root cause has been announced.

Three days before the grounding, the FAA also rolled out a new AI-based air traffic tool called SMART. Officials say the new AI systems played no role, and its maker denies any link.

Whatever the final finding, the pattern is clear. When you attach new systems to infrastructure built decades ago, the join between them becomes the weak point. A September 2025 GAO report had already warned about ageing copper cabling and poorly scheduled system changes. The warning was on record before Friday.

Question three: Where did the money go?

Duffy is now asking for $50 billion to modernise air traffic control and blaming Congress for not funding it. But Congress approved $12.5 billion last year for exactly this work. Before anyone signs off on another $30 billion or more, the public should know how much of that first tranche has been spent, on what, and how far the work has got.

Question four: Are we sure this wasn’t an attack?

The timing invites suspicion. October was so bad that security researchers called it “Black October”: a wave of attacks through software suppliers, cloud accounts and update channels. Ransomware leak sites listed 45% more victims this year than in 2025. Weeks later, two critical systems failed back to back.

Officials say there was no attack. Mullin said investigators had seen “no chatter” and “no footprints,” but he would not rule it out. The NSA, the Department of Defense and CISA are all involved. Bloomberg reports that the FBI does not believe a cyberattack caused the outage. That much attention means people are checking. It doesn’t mean they’ve found anything.

The evidence available today points to self-inflicted failures: a configuration change at Microsoft and a network update at the FAA.

That may be the more worrying answer. If a routine update can do as much damage as a serious attack, then these systems are no more resilient against honest mistakes than against hostile ones. Every attacker watching last week now knows where the weak points are.

Early statements after major incidents have been wrong before. TechBytes will compare what officials said this week with the final root-cause reports when they are published.

The real issue: concentration risk

Set the details aside and both outages show the same problem. Critical public services now depend on very few points of failure.

When Microsoft went down, Australia had to invoke a special resilience agreement to get priority support. New York City told residents to call 311 or 911 because city email might not get through. Regional government offices closed and court hearings were postponed. None of these institutions was attacked. They had simply built their operations on one supplier with no working alternative.

Nobody voted for that level of dependency, and few regulators measure it. A plane crash triggers an independent investigation by law. A 21-hour outage of a platform that governments rely on triggers whatever report the vendor decides to publish.

What to watch

The real story will come out in the documents. Watch for three things:

• Microsoft’s Post Incident Review for incident MO1550821, and whether it explains why the staged rollout failed.
• The FAA’s official root-cause finding, and whether it confirms the network update and who signed off on it.
• Senator Tammy Duckworth’s call for a “thorough and complete” investigation, and whether it turns into formal hearings.

TechBytes Africa will read those documents when they come out and report what they say. The first-day statements answered whether this was an attack. The harder questions, about design, oversight and dependency, are still open.

Read our earlier coverage: Microsoft 365 Goes Dark: Fixes Keep Failing in Global Outlook and Teams Outage