ALT-53 · Analysis · 23 Oct 2026
The CrowdStrike outage: a security update that stopped the world
A faulty content update for a widely used security agent crashed about 8.5 million Windows machines in July 2024 — airlines, hospitals, banks. Not an attack: a lesson in kernel trust and staged rollouts.
- 04:09 UTC, 19 Jul 2024Channel File 291 update released.
- 05:27 UTCThe update is reverted.
- Following daysManual recovery of affected machines across industries.
- 6 Aug 2024CrowdStrike publishes its root-cause analysis.
- Windows devices affected
- ~8.5MMicrosoft
- Before the faulty update was reverted
- 78 minCrowdStrike
What went wrong
A new template type defined 21 input fields; the sensor code supplied 20. Tests had not exercised the case that read the 21st. The content update was treated as data rather than code, so it went to all customers at once instead of in stages.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Configuration that changes kernel behaviour is code, and should ship like code.
- Staged rollouts exist for the update that everyone is sure is safe.
- Security tools sit in the most privileged place on a system; their failures are total.
What to do
- Ask vendors how they stage content and configuration updates, and whether you can control the pace.
- Practise recovering machines that will not boot, including encrypted ones (keep recovery keys reachable).
- Ring-deploy your own changes: canary, small group, everyone.
Sources
- CrowdStrike — Channel File 291 incident root cause analysis (PDF)
- Microsoft — Helping our customers through the CrowdStrike outage
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-53 — The CrowdStrike outage: a security update that stopped the world. 23 Oct 2026. altumptic.com/research/crowdstrike-outage-2024