A faulty CrowdStrike configuration update crashes Windows systems around the world. Microsoft estimates 8.5 million affected devices. The security software, not a cyberattack, is responsible.
The protection became the problem.
At 04:09 UTC on Friday, 19 July 2024, CrowdStrike released a content configuration update for its Falcon security software on Windows.
Around the world, affected machines began crashing.
This story uses the global incident’s documented UTC chronology. At the moment of release, it was still Thursday evening in North America, including 9:09 p.m. on 18 July in Pacific daylight time.
The date basis matters. So does the identity of the update.
This was not a Microsoft Windows Update, and it was not a cyberattack. It was security content distributed by a company whose business was protecting computers from attacks.
Certain Windows machines running Falcon sensor version 7.11 or later received the defective configuration. Mac and Linux systems were not affected by this update. Nor was every Windows computer.
CrowdStrike’s root-cause summary describes a mismatch: the sensor expected 20 input fields, while the update provided 21. The resulting out-of-bounds memory read caused a system crash.
One extra field had consequences far beyond one computer.
At 05:27 UTC, the faulty content was reverted. It had been available for 78 minutes.
That was the distribution window, not the duration of the worldwide disruption.
Machines that had already crashed did not all recover simply because the update had been withdrawn. Restoring them could require hands-on technical work, sometimes across very large fleets of computers.
Air travel, healthcare, banking and other services experienced disruption. These were real operational consequences for people relying on those systems, not merely an amusing collection of blue screens.
Microsoft subsequently estimated that 8.5 million Windows devices were affected—less than one percent of all Windows machines.
That was an estimate, not a confirmed count of screens turning blue simultaneously.
The proportion sounds small until the machines belong to organizations running essential services. The importance of a computer is not measured by its share of the global population.
The security software had become the source of the failure it was supposed to help prevent.
No hacker was required.
A configuration update from a cybersecurity provider disrupted millions of computers and critical services. The central contradiction is institutional: the protective system itself introduced the failure.
The threat arrived through the protection.
Evidence status
Sources
Provider’s technical chronology
CrowdStrike — Technical Details: Falcon Content Update for Windows Hosts
Original language: EnglishProvider’s root-cause investigation
CrowdStrike — Channel File 291 Root Cause Analysis
CrowdStrike — Root Cause Analysis executive summary · 6 August 2024 (PDF)
Original language: EnglishAffected-device estimate and recovery account
Microsoft — Helping our customers through the CrowdStrike outage · 20 July 2024
Original language: EnglishHealthcare-sector impact
U.S. HHS — Global Technology Outage sector alert · 23 July 2024 (PDF)
Original language: English