Loading story…
A faulty CrowdStrike Falcon content update caused a widespread IT outage that crashed Windows systems with blue screens and disrupted airlines, hospitals, banks, and other organizations worldwide. CISA said the incident was not linked to malicious cyber activity, and CrowdStrike said a fix had been deployed, while Microsoft estimated the outage affected about 8.5 million Windows devices. Reporting also indicated the Falcon Sensor was tied to some Linux instability, widening concern over the operational risk of security-agent updates and the difficulty of safely testing near-real-time threat content at global scale.
The disruption was quickly exploited by cybercriminals, who used the confusion to launch phishing campaigns and distribute fake CrowdStrike fixes carrying malware and even data wipers. Security agencies and researchers warned that attackers were impersonating CrowdStrike support and related recovery efforts to target affected companies, including organizations seeking urgent remediation. The fallout extended beyond immediate recovery, with the event prompting scrutiny of software update processes, resilience planning, and vendor concentration risk, and later contributing to legal disputes over responsibility for business losses.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Delta Air Lines and CrowdStrike filed opposing lawsuits tied to the consequences of the July outage, marking a legal escalation over responsibility and damages. The litigation showed the long-tail business impact of the incident months later.
India's CERT-In said threat actors were using the global CrowdStrike outage to launch phishing attacks against users and organizations. The warning reflected continued malicious exploitation of the incident days after the initial disruption.
Reports emerged that CrowdStrike's Falcon Sensor had also been associated with Linux system crashes and restoration issues, expanding concerns beyond the Windows outage. The issue highlighted broader operational risks tied to endpoint security updates.
Following the outage, attackers began exploiting the incident with phishing emails, malicious websites, and fake CrowdStrike fixes that delivered malware or data wipers. Multiple reports described cybercriminals using the disruption as social-engineering bait.
Microsoft disclosed that the CrowdStrike-related outage impacted an estimated 8.5 million Windows devices worldwide, quantifying the scale of the incident. The figure underscored the breadth of disruption caused by the bad update.
CrowdStrike confirmed that the outage was tied to a faulty update and said a fix had been deployed. Guidance and recovery steps began circulating as affected organizations worked to restore impacted systems.
A defective CrowdStrike Falcon content update caused Windows systems to crash with blue screens, leading to a major global IT outage affecting organizations across multiple sectors. CISA issued an alert about the disruption on the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
12 references tracked. Mallory keeps watching after this page renders.
restofworld.org
Open sourceciodive.com
Open sourceindianexpress.com
Open sourcecyberscoop.com
Open sourceblogs.microsoft.com
Open sourcescworld.com
Open sourcewelivesecurity.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A defective **CrowdStrike Falcon** content update triggered widespread **Windows** system crashes, knocking PCs and servers offline across airlines, banks, hospitals, broadcasters, retailers, and government services. Organizations around the world reported machines stuck on the **Blue Screen of Death**, disrupting flight operations, payment processing, emergency care, call centers, and other frontline services. Reporting said the incident was not a cyberattack but a software failure in a security product deeply embedded in enterprise Windows environments, causing simultaneous outages at a global scale. CrowdStrike said the problem stemmed from a bad update to its sensor for Windows and moved to withdraw the faulty content, while Microsoft systems were heavily affected because the issue hit endpoints running the security tool. Airlines canceled and delayed flights, airports reverted to manual procedures, hospitals postponed appointments, and financial institutions faced service interruptions as IT teams worked machine by machine to restore affected devices. The outage drew comparisons to a supply-chain-style technology failure because a single vendor update cascaded across thousands of organizations, though unlike the **SolarWinds Orion** compromise, the disruption was attributed to an accidental software defect rather than malicious intrusion.
Jul 12, 2026
A defective CrowdStrike Falcon sensor content update on 19 July 2024 caused Windows systems to enter crash loops globally, disrupting aviation, finance, healthcare, education, government services and other sectors, including multiple organizations in the Netherlands. The faulty channel file was identified as `C-00000291*.sys` stamped 0409 UTC; versions stamped 0527 UTC or later were valid. The incident prevented an estimated 8.5 million computers from booting and demonstrated how a failure in a widely deployed security product can create systemic disruption without a malicious attack. Organizations were advised to restart affected hosts to obtain the corrected channel file, while crash-looping devices required recovery-mode or Safe Mode remediation to remove or rename the faulty CrowdStrike driver, with separate considerations for BitLocker-protected and RAID-configured systems. Cloud providers including AWS, Microsoft Azure and Google Cloud issued recovery guidance for affected Windows virtual machines. Dutch authorities cited the outage in the 2024 Cyber Security Assessment as evidence of digital-monoculture risk and the need to prepare for major disruptions caused by technical failures and human error as well as cyberattacks.
Sep 3, 2026
A researcher known as Chaotic Eclipse, Nightmare-Eclipse, MSNightmare, and INFINITE NIGHTMARE released **FalconFlank**, a public proof of concept claiming a zero-day local privilege-escalation flaw in the CrowdStrike Falcon Sensor. The technique allegedly abuses Falcon’s privileged remediation workflow for Microsoft Office files identified as containing malicious macros, potentially allowing a low-privileged local Windows user to execute in a more privileged—potentially `SYSTEM`—context. The researcher reported successful testing on fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon with **Phase 3 – Optimal Protection** and the Office macro-removal capability enabled. CrowdStrike had not published an advisory, CVE, patch, or confirmation at the time of reporting; affected versions, exploit reliability, prerequisites, and mitigations remain unverified. Organizations using the specified Falcon configuration should monitor for vendor guidance and investigate whether local-access threats could abuse the remediation feature.
Sep 9, 2026