https://pwn.watch/t/edr Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 06 Aug 2024 00:00:00 GMT https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage Tue, 06 Aug 2024 00:00:00 GMT critical <p>A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)</p> <p><strong>Latest updates:</strong></p><ul><li>2024-08-06: CrowdStrike publishes the Channel File 291 root cause analysis (<a href="https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf">source</a>)</li><li>2024-07-20: CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected (<a href="https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/">source</a>)</li><li>2024-07-19: 04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash (<a href="https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/">source</a>)</li></ul>