Loading story…
A defective CrowdStrike Falcon content update triggered widespread Windows system crashes, knocking PCs and servers offline across airlines, banks, hospitals, broadcasters, retailers, and government services. Organizations around the world reported machines stuck on the Blue Screen of Death, disrupting flight operations, payment processing, emergency care, call centers, and other frontline services. Reporting said the incident was not a cyberattack but a software failure in a security product deeply embedded in enterprise Windows environments, causing simultaneous outages at a global scale.
CrowdStrike said the problem stemmed from a bad update to its sensor for Windows and moved to withdraw the faulty content, while Microsoft systems were heavily affected because the issue hit endpoints running the security tool. Airlines canceled and delayed flights, airports reverted to manual procedures, hospitals postponed appointments, and financial institutions faced service interruptions as IT teams worked machine by machine to restore affected devices. The outage drew comparisons to a supply-chain-style technology failure because a single vendor update cascaded across thousands of organizations, though unlike the SolarWinds Orion compromise, the disruption was attributed to an accidental software defect rather than malicious intrusion.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
The Windows outage caused grounded flights, airport delays, banking disruptions, and broad operational chaos as organizations worked to recover systems over the course of the day and into the weekend.
After the outage began, CrowdStrike said the incident was not a cyberattack, identified a problematic Falcon sensor update affecting Windows, and issued guidance to help organizations restore impacted machines.
A defective CrowdStrike Falcon content update caused widespread Windows system crashes and outages across sectors including airlines, airports, banks, and other businesses worldwide.
Cisco said it found and mitigated affected SolarWinds software in a small number of lab systems and employee endpoints, while Equifax reportedly found malware on servers but said it saw no evidence of data theft.
Microsoft reported that it had alerted 40 customers across multiple countries that were breached in the SolarWinds espionage campaign, underscoring the international scope of the compromise.
The FBI and Department of Homeland Security investigated the SolarWinds incident while U.S. officials and intelligence sources publicly assessed that Russia's Foreign Intelligence Service was likely responsible. Moscow denied involvement.
The SolarWinds Orion breach came to light as multiple U.S. federal agencies and private-sector organizations were identified as affected or investigating exposure. Reported victims included Treasury, Commerce, Homeland Security, State, NIH, and later companies such as Microsoft, Cisco, Equifax, GE, and Cox.
Suspected Russian operators began compromising networks via trojanized SolarWinds Orion software updates, with reporting indicating the intrusion activity stretched back to March 2020.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourceslate.com
Open sourcecnn.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A faulty **CrowdStrike Falcon** content update caused a widespread IT outage that crashed Windows systems with blue screens and disrupted airlines, hospitals, banks, and other organizations worldwide. **CISA** said the incident was not linked to malicious cyber activity, and CrowdStrike said a fix had been deployed, while Microsoft estimated the outage affected about **8.5 million Windows devices**. Reporting also indicated the Falcon Sensor was tied to some **Linux** instability, widening concern over the operational risk of security-agent updates and the difficulty of safely testing near-real-time threat content at global scale. The disruption was quickly exploited by cybercriminals, who used the confusion to launch phishing campaigns and distribute **fake CrowdStrike fixes** carrying malware and even data wipers. Security agencies and researchers warned that attackers were impersonating CrowdStrike support and related recovery efforts to target affected companies, including organizations seeking urgent remediation. The fallout extended beyond immediate recovery, with the event prompting scrutiny of software update processes, resilience planning, and vendor concentration risk, and later contributing to legal disputes over responsibility for business losses.
Sep 5, 2026
A defective CrowdStrike Falcon sensor content update on 19 July 2024 caused Windows systems to enter crash loops globally, disrupting aviation, finance, healthcare, education, government services and other sectors, including multiple organizations in the Netherlands. The faulty channel file was identified as `C-00000291*.sys` stamped 0409 UTC; versions stamped 0527 UTC or later were valid. The incident prevented an estimated 8.5 million computers from booting and demonstrated how a failure in a widely deployed security product can create systemic disruption without a malicious attack. Organizations were advised to restart affected hosts to obtain the corrected channel file, while crash-looping devices required recovery-mode or Safe Mode remediation to remove or rename the faulty CrowdStrike driver, with separate considerations for BitLocker-protected and RAID-configured systems. Cloud providers including AWS, Microsoft Azure and Google Cloud issued recovery guidance for affected Windows virtual machines. Dutch authorities cited the outage in the 2024 Cyber Security Assessment as evidence of digital-monoculture risk and the need to prepare for major disruptions caused by technical failures and human error as well as cyberattacks.
Sep 3, 2026
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Aug 21, 2026