https://pwn.watch/t/crowdstrike Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 23 Sep 2025 00:00:00 GMT https://pwn.watch/i/shai-hulud-npm-worm-september-2025 https://pwn.watch/i/shai-hulud-npm-worm-september-2025 Tue, 23 Sep 2025 00:00:00 GMT critical <p>A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Malicious versions removed from npm; upgrade to versions published after the incident</p> <p><strong>Latest updates:</strong></p><ul><li>2025-09-23: CISA alert: widespread supply chain compromise impacting npm (500+ packages) (<a href="https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem">source</a>)</li><li>2025-09-16: Largest burst, nearly 100 packages, including @crowdstrike scope (<a href="https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages">source</a>)</li><li>2025-09-15: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised (<a href="https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages">source</a>)</li></ul> https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage Tue, 06 Aug 2024 00:00:00 GMT critical <p>A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)</p> <p><strong>Latest updates:</strong></p><ul><li>2024-08-06: CrowdStrike publishes the Channel File 291 root cause analysis (<a href="https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf">source</a>)</li><li>2024-07-20: CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected (<a href="https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/">source</a>)</li><li>2024-07-19: 04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash (<a href="https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/">source</a>)</li></ul>