# CrowdStrike Falcon update crashes 8.5 million Windows machines · pwn.watch

> A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.

Page: https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage · generated 2026-10-22T22:00:08.805Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: CrowdStrike Falcon sensor for Windows
- Started: 2024-07-19 · closed: 2024-08-06
- Affected: Falcon sensor for Windows 7.11 and above, online 04:09-05:27 UTC on 2024-07-19 (CrowdStrike)
- Fixed in: Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage/feed.xml
- JSON Feed: https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage.json
- This file: https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage/llms.txt

## Updates (newest first)
- 2024-08-06: CrowdStrike publishes the Channel File 291 root cause analysis (https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf)
- 2024-07-20: CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected (https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/)
- 2024-07-19: 04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash (https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/)
- 2024-07-19: 05:27 UTC: the faulty update is remediated (https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/)

## Fix brief
# Security brief: CrowdStrike Falcon update crashes 8.5 million Windows machines

Source: https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage · status: closed (closed Aug 6, 2024) · severity: critical · updated Aug 6, 2024

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.

Severity detail: Not an attack: faulty security update, global outage

- Product: CrowdStrike Falcon sensor for Windows

## Affected versions
- Falcon sensor for Windows 7.11 and above, online 04:09-05:27 UTC on 2024-07-19 (CrowdStrike)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Aug 6, 2024: CrowdStrike publishes the Channel File 291 root cause analysis
- Jul 20, 2024: CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected
- Jul 19, 2024: 04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash
- Jul 19, 2024: 05:27 UTC: the faulty update is remediated

## Advisories
- [Falcon content update remediation and guidance hub](https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/) (CrowdStrike)

## Write-ups & news
- [Technical details: Falcon content update for Windows hosts](https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/)
- [Helping our customers through the CrowdStrike outage](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/)
- [Channel File 291 incident root cause analysis](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf)

---
Machine-readable: https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.