CrowdStrike: Falcon sensor channel-file update crashes 8.5M Windows hosts
A defective rapid-response content update to the Falcon endpoint sensor was deployed simultaneously to all production hosts, causing kernel-level crashes on ~8.5 million Windows machines worldwide.
2 of the 4 practices that failed in this incident are part of the Sentinel-10 — the engineering protocols Concordance flags as most degraded under AI-accelerated development.
This incident pre-dates today's AI-velocity surge. The thesis is that the same practices that failed here will fail faster under AI velocity if not actively governed. Read the Velocity Governance thesis →
Impact
Estimated $10B+ economic impact. Grounded airlines (Delta alone reported $500M loss), shut hospitals, halted broadcasts. Largest single IT outage in history.
Root cause (from published RCA)
A new Template Type for IPC detections was introduced and validated through Content Validator. The Content Configuration System later passed a Template Instance to the sensor that contained problematic content data, which the Content Interpreter could not gracefully handle. The new content was deployed to all hosts simultaneously without staged rollout.
Concordance protocols that map to this root cause
Click any protocol to see every other indexed incident where it failed.
Primary sources
Related incidents
Other incidents that failed at least one of the same protocols.